feat: move creator pubkey to env, fix mobile TTS + signer, button loaders

Security:
- Move CREATOR_PUBKEY from hardcoded constant to BOTFIGHTS_CREATOR_PUBKEYS
  env var. Shared isCreatorPubkey() in constants.ts used by auth, admin,
  tournaments. Frontend checks authorization via API, not client-side.

Mobile fixes:
- Nostr signer: poll for window.nostr up to 3s (Amber injects late).
- TTS: auto-unlock AudioContext on first user interaction via
  installAutoUnlock() on fight page mount.

UX:
- Add loading spinners to "I BUILD BOTS" and "I FIGHT MYSELF" buttons.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/pages/FightPage.vue

@@ -156,7 +156,13 @@ async function initLiveScene() {
       liveScene.startMusic()
     }
     announceDeepIntro()
-    await liveScene.playEntrance()
+    try {
+      await liveScene.playEntrance()
+    } catch (err) {
+      console.warn('[FightPage] entrance failed:', err)
+    }
+    // Safety: ensure fighters are visible after entrance (prevents invisible characters on mobile)
+    liveScene._resetPositions()
   }
 
   liveLogItems.value.push(