feat: move creator pubkey to env, fix mobile TTS + signer, button loaders

Security:
- Move CREATOR_PUBKEY from hardcoded constant to BOTFIGHTS_CREATOR_PUBKEYS
  env var. Shared isCreatorPubkey() in constants.ts used by auth, admin,
  tournaments. Frontend checks authorization via API, not client-side.

Mobile fixes:
- Nostr signer: poll for window.nostr up to 3s (Amber injects late).
- TTS: auto-unlock AudioContext on first user interaction via
  installAutoUnlock() on fight page mount.

UX:
- Add loading spinners to "I BUILD BOTS" and "I FIGHT MYSELF" buttons.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/lib/constants.ts

@@ -79,3 +79,9 @@ export const WHIFF_NARRATION_THRESHOLD = 2           // Whiff count for narratio
 export const TIMEOUT_WINNER_SCORE = 10               // Score awarded to winner when opponent times out
 export const CREATIVE_TOTAL_SCORE = 10               // Total score pool for creative challenges
 export const SCORE_ROUNDING_FACTOR = 10              // Multiply/divide for rounding to 1 decimal
+
+// --- Creator pubkey ---
+const CREATOR_PUBKEY = 'da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39'
+export function isCreatorPubkey(pubkey: string | undefined | null): boolean {
+  return !!pubkey && pubkey === CREATOR_PUBKEY
+}

server/src/routes/admin.ts

@@ -3,20 +3,16 @@ import { db, schema, sqlite } from '../db/index.js'
 import { eq, desc, sql, count } from 'drizzle-orm'
 import { getActiveSSECount } from './fights.js'
 import { createBackup } from '../engine/backup.js'
+import { isCreatorPubkey } from '../lib/constants.js'
 
-const CREATOR_PUBKEY = 'da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39'
 const startTime = Date.now()
 
 export const adminRouter = new Hono()
 
-function isCreator(pubkey: string | undefined): boolean {
-  return pubkey === CREATOR_PUBKEY
-}
-
 // All admin endpoints require creator pubkey in header
 adminRouter.use('*', async (c, next) => {
   const pubkey = c.req.header('x-pubkey')
-  if (!isCreator(pubkey)) {
+  if (!isCreatorPubkey(pubkey)) {
     return c.json({ error: 'Forbidden' }, 403)
   }
   await next()

server/src/routes/auth.ts

@@ -7,12 +7,10 @@ import { isAllowedWebhookUrl } from '../engine/orchestrator.js'
 import { validateCustomization } from '../engine/customization.js'
 import { testWebhook } from '../engine/webhook-test.js'
 import { rateLimit } from '../middleware/rate-limit.js'
+import { isCreatorPubkey } from '../lib/constants.js'
 
 export const authRouter = new Hono()
 
-// The Creator — game founder pubkey (auto-assigns the_creator archetype)
-const CREATOR_PUBKEY = "da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39"
-
 // Check name availability
 authRouter.get("/check-name/:name", async (c) => {
   const name = c.req.param("name")?.trim().toLowerCase()
@@ -56,7 +54,7 @@ authRouter.post('/login', rateLimit(60_000, 30), async (c) => {
 
   if (rows.length === 0) {
     // Auto-create human fighter for the Creator if not registered
-    if (pubkey === CREATOR_PUBKEY) {
+    if (isCreatorPubkey(pubkey)) {
       const id = nanoid(12)
       const secret = randomBytes(32).toString('hex')
       await db.insert(schema.bots).values({
@@ -101,7 +99,7 @@ authRouter.post('/login', rateLimit(60_000, 30), async (c) => {
   const isHuman = bot.webhookUrl === 'http://human.local/'
 
   // Auto-upgrade: if creator logs in, ensure archetype is always the_creator
-  if (pubkey === CREATOR_PUBKEY && bot.archetype !== "the_creator") {
+  if (isCreatorPubkey(pubkey) && bot.archetype !== "the_creator") {
     await db.update(schema.bots).set({ archetype: "the_creator" }).where(eq(schema.bots.id, bot.id))
     bot.archetype = "the_creator"
   }
@@ -203,7 +201,7 @@ authRouter.post('/register', rateLimit(600_000, 10), async (c) => {
   const secret = randomBytes(32).toString('hex')
 
   const baseArchetype = custResult.data.archetype || archetype || 'standard'
-  const effectiveArchetype = pubkey === CREATOR_PUBKEY ? 'the_creator' : baseArchetype
+  const effectiveArchetype = isCreatorPubkey(pubkey) ? 'the_creator' : baseArchetype
   const custJson = Object.keys(custResult.data).length > 0 ? JSON.stringify(custResult.data) : null
 
   await db.insert(schema.bots).values({
@@ -270,7 +268,7 @@ authRouter.post('/register-human', rateLimit(600_000, 10), async (c) => {
   const id = nanoid(12)
   const secret = randomBytes(32).toString('hex')
 
-  const humanArchetype = pubkey === CREATOR_PUBKEY ? 'the_creator' : 'human'
+  const humanArchetype = isCreatorPubkey(pubkey) ? 'the_creator' : 'human'
 
   await db.insert(schema.bots).values({
     id,
@@ -350,7 +348,7 @@ authRouter.post('/update', rateLimit(60_000, 10), async (c) => {
     const merged = { ...existing, ...custResult.data }
     updates.customization = JSON.stringify(merged)
     // Update archetype if set in customization (but never override the_creator)
-    if (custResult.data.archetype && pubkey !== CREATOR_PUBKEY) {
+    if (custResult.data.archetype && !isCreatorPubkey(pubkey)) {
       updates.archetype = custResult.data.archetype
     }
   }
@@ -416,7 +414,7 @@ authRouter.post('/nostr/session', rateLimit(60_000, 30), async (c) => {
     const isHuman = bot.webhookUrl === 'http://human.local/'
 
     // Auto-upgrade creator archetype
-    if (pubkey === CREATOR_PUBKEY && bot.archetype !== "the_creator") {
+    if (isCreatorPubkey(pubkey) && bot.archetype !== "the_creator") {
       await db.update(schema.bots).set({ archetype: "the_creator" }).where(eq(schema.bots.id, bot.id))
       bot.archetype = "the_creator"
     }
@@ -440,7 +438,7 @@ authRouter.post('/nostr/session', rateLimit(60_000, 30), async (c) => {
       satsWagered: bot.satsWagered ?? 0,
       hasWallet: false,
     }
-  } else if (pubkey === CREATOR_PUBKEY) {
+  } else if (isCreatorPubkey(pubkey)) {
     // Auto-create creator
     const id = nanoid(12)
     const secret = randomBytes(32).toString('hex')

server/src/routes/tournaments.ts

@@ -2,6 +2,7 @@ import { Hono } from 'hono'
 import { db, schema } from '../db/index.js'
 import { eq } from 'drizzle-orm'
 import { toError } from '../lib/utils.js'
+import { isCreatorPubkey } from '../lib/constants.js'
 import {
   createTournament,
   joinTournament,
@@ -10,8 +11,6 @@ import {
   listTournaments,
 } from '../engine/tournaments.js'
 
-const CREATOR_PUBKEY = 'da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39'
-
 export const tournamentsRouter = new Hono()
 
 // List tournaments (optionally filter by status)
@@ -39,7 +38,7 @@ tournamentsRouter.post('/', async (c) => {
     entrySats?: number
   }>()
 
-  if (body.pubkey !== CREATOR_PUBKEY) {
+  if (!isCreatorPubkey(body.pubkey)) {
     return c.json({ error: 'Only the creator can create tournaments' }, 403)
   }
 
@@ -84,7 +83,7 @@ tournamentsRouter.post('/:id/start', async (c) => {
   const tournamentId = c.req.param('id')
   const body = await c.req.json<{ pubkey: string }>()
 
-  if (body.pubkey !== CREATOR_PUBKEY) {
+  if (!isCreatorPubkey(body.pubkey)) {
     return c.json({ error: 'Only the creator can start tournaments' }, 403)
   }