feat: THE CREATOR god-tier character, bitcoin choreographies, omni-morph, cameos

- Guy Fawkes mask archetype with golden outline, bitcoin chest symbol, laptop, tier-gated effects
- 12 custom bitcoin-themed choreographies (8 regular + 4 exclusive ultimates)
- Omni-morph system: creator morphs into any of 80+ archetypes instead of cycling 3
- 6% per-round cameo in non-creator fights — drops golden ₿ gifts to fighters
- Custom golden code rain entrance with persistent orbiting particles
- pickChoreography: 50% ultimate chance (100% on crits), all tier ultimates + 4 exclusive
- Server auto-assigns the_creator archetype on login/register for creator pubkey
- FightViewer, payments, queue, orchestrator improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/auth.ts

@@ -10,6 +10,9 @@ import { rateLimit } from '../middleware/rate-limit.js'
 
 export const authRouter = new Hono()
 
+// The Creator — game founder pubkey (auto-assigns the_creator archetype)
+const CREATOR_PUBKEY = "da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39"
+
 // Check name availability
 authRouter.get("/check-name/:name", async (c) => {
   const name = c.req.param("name")?.trim().toLowerCase()
@@ -58,6 +61,12 @@ authRouter.post('/login', async (c) => {
   const bot = rows[0]
   const isHuman = bot.webhookUrl === 'http://human.local/'
 
+  // Auto-upgrade: if creator logs in, ensure archetype is always the_creator
+  if (pubkey === CREATOR_PUBKEY && bot.archetype !== "the_creator") {
+    await db.update(schema.bots).set({ archetype: "the_creator" }).where(eq(schema.bots.id, bot.id))
+    bot.archetype = "the_creator"
+  }
+
   return c.json({
     exists: true,
     bot: {
@@ -154,7 +163,8 @@ authRouter.post('/register', rateLimit(3600_000, 15), async (c) => {
   const id = nanoid(12)
   const secret = randomBytes(32).toString('hex')
 
-  const effectiveArchetype = custResult.data.archetype || archetype || 'standard'
+  const baseArchetype = custResult.data.archetype || archetype || 'standard'
+  const effectiveArchetype = pubkey === CREATOR_PUBKEY ? 'the_creator' : baseArchetype
   const custJson = Object.keys(custResult.data).length > 0 ? JSON.stringify(custResult.data) : null
 
   await db.insert(schema.bots).values({
@@ -248,7 +258,7 @@ authRouter.post('/update', async (c) => {
   const body = await c.req.json()
   const { pubkey, webhookUrl, profilePicUrl, customization: rawCustomization } = body
 
-  if (!pubkey || typeof pubkey !== 'string') {
+  if (!pubkey || typeof pubkey !== 'string' || pubkey.length !== 64) {
     return c.json({ error: 'Invalid pubkey.' }, 400)
   }
 
@@ -264,6 +274,9 @@ authRouter.post('/update', async (c) => {
   const updates: Record<string, unknown> = {}
 
   if (webhookUrl) {
+    if (typeof webhookUrl !== 'string' || webhookUrl.length > 2048) {
+      return c.json({ error: 'Invalid webhookUrl.' }, 400)
+    }
     if (!isAllowedWebhookUrl(webhookUrl)) {
       return c.json({ error: 'webhookUrl must not point to private/internal addresses.' }, 400)
     }
@@ -279,7 +292,12 @@ authRouter.post('/update', async (c) => {
     updates.isActive = true
   }
 
-  if (profilePicUrl) updates.profilePicUrl = profilePicUrl
+  if (profilePicUrl) {
+    if (typeof profilePicUrl !== 'string' || profilePicUrl.length > 2048 || !/^https?:\/\//.test(profilePicUrl)) {
+      return c.json({ error: 'profilePicUrl must be a valid HTTP(S) URL.' }, 400)
+    }
+    updates.profilePicUrl = profilePicUrl
+  }
 
   if (rawCustomization !== undefined) {
     const custResult = validateCustomization(rawCustomization)