fix: fight restart bug, mobile TTS, character sizing, bitcoin symbols

- Fix fight replay showing empty scene: validate rounds before playing,
  retry loading fight data up to 5 times when rounds are missing
- Add COOP/COEP headers to production server for SharedArrayBuffer
  (required by Kokoro TTS WASM threading on mobile)
- Add blob: to scriptSrc/workerSrc CSP for Web Worker support
- Fix mobile character cutoff: raise ground line to 0.82, add
  MOBILE_SCALE_CAP (0.55) so fighters never shrink too small
- Add ₿ bitcoin chest badge to all fighter sprites (scales with tier)
- Add sats coin stack on bot profile page proportional to satsWon
- Seed dev tournament with 8 mock bots on startup (dev mode only)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/app.ts

@@ -36,15 +36,23 @@ app.use('*', logger())
 const allowedOrigin = process.env.CORS_ORIGIN || '*'
 app.use('/api/*', cors({ origin: allowedOrigin }))
 
+// COOP/COEP headers: required for SharedArrayBuffer (Kokoro TTS WASM threading)
+app.use('*', async (c, next) => {
+  await next()
+  c.header('Cross-Origin-Opener-Policy', 'same-origin')
+  c.header('Cross-Origin-Embedder-Policy', 'credentialless')
+})
+
 // Security headers: X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, etc.
 app.use('*', secureHeaders({
   contentSecurityPolicy: process.env.NODE_ENV === 'production' ? {
     defaultSrc: ["'self'"],
-    scriptSrc: ["'self'"],
+    scriptSrc: ["'self'", 'blob:'],
     styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
     imgSrc: ["'self'", 'data:', 'blob:'],
     connectSrc: ["'self'"],
     fontSrc: ["'self'", 'https://fonts.gstatic.com'],
+    workerSrc: ["'self'", 'blob:'],
   } : undefined,
 }))