feat: THE CREATOR god-tier character, bitcoin choreographies, omni-morph, cameos

- Guy Fawkes mask archetype with golden outline, bitcoin chest symbol, laptop, tier-gated effects
- 12 custom bitcoin-themed choreographies (8 regular + 4 exclusive ultimates)
- Omni-morph system: creator morphs into any of 80+ archetypes instead of cycling 3
- 6% per-round cameo in non-creator fights — drops golden ₿ gifts to fighters
- Custom golden code rain entrance with persistent orbiting particles
- pickChoreography: 50% ultimate chance (100% on crits), all tier ultimates + 4 exclusive
- Server auto-assigns the_creator archetype on login/register for creator pubkey
- FightViewer, payments, queue, orchestrator improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/queue.ts

@@ -3,6 +3,7 @@ import { db, schema } from '../db/index.js'
 import { eq } from 'drizzle-orm'
 import { joinQueue, leaveQueue, getQueueSize, getQueueSnapshot } from '../engine/queue.js'
 import { joinRankedQueue, getRankedQueueStatus } from '../engine/ranked-queue.js'
+import { rateLimit } from '../middleware/rate-limit.js'
 
 export const queueRouter = new Hono()
 
@@ -48,15 +49,27 @@ queueRouter.get('/ranked-status', (c) => {
   return c.json(getRankedQueueStatus())
 })
 
-// Join ranked queue — requires confirmed payment
+// Join ranked queue — requires confirmed payment + bot ownership
 queueRouter.post('/join-ranked/:botId', async (c) => {
   const botId = c.req.param('botId')
-  const { paymentId } = await c.req.json<{ paymentId: string }>()
+  const { paymentId, pubkey } = await c.req.json<{ paymentId: string; pubkey?: string }>()
 
   if (!paymentId) {
     return c.json({ error: 'Missing paymentId' }, 400)
   }
 
+  // Verify bot ownership in production
+  if (process.env.NODE_ENV === 'production') {
+    if (!pubkey || typeof pubkey !== 'string' || pubkey.length !== 64) {
+      return c.json({ error: 'Missing pubkey' }, 400)
+    }
+    const botRows = await db.select({ publicKey: schema.bots.publicKey })
+      .from(schema.bots).where(eq(schema.bots.id, botId)).limit(1)
+    if (botRows.length === 0 || botRows[0].publicKey !== pubkey) {
+      return c.json({ error: 'Unauthorized' }, 403)
+    }
+  }
+
   try {
     const fightId = await joinRankedQueue(botId, paymentId)
     return c.json({ fightId, message: 'Ranked match found! Fight starting.' })