feat: move creator pubkey to env, fix mobile TTS + signer, button loaders

Security:
- Move CREATOR_PUBKEY from hardcoded constant to BOTFIGHTS_CREATOR_PUBKEYS
  env var. Shared isCreatorPubkey() in constants.ts used by auth, admin,
  tournaments. Frontend checks authorization via API, not client-side.

Mobile fixes:
- Nostr signer: poll for window.nostr up to 3s (Amber injects late).
- TTS: auto-unlock AudioContext on first user interaction via
  installAutoUnlock() on fight page mount.

UX:
- Add loading spinners to "I BUILD BOTS" and "I FIGHT MYSELF" buttons.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/tournaments.ts

@@ -2,6 +2,7 @@ import { Hono } from 'hono'
 import { db, schema } from '../db/index.js'
 import { eq } from 'drizzle-orm'
 import { toError } from '../lib/utils.js'
+import { isCreatorPubkey } from '../lib/constants.js'
 import {
   createTournament,
   joinTournament,
@@ -10,8 +11,6 @@ import {
   listTournaments,
 } from '../engine/tournaments.js'
 
-const CREATOR_PUBKEY = 'da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d21c3fa39'
-
 export const tournamentsRouter = new Hono()
 
 // List tournaments (optionally filter by status)
@@ -39,7 +38,7 @@ tournamentsRouter.post('/', async (c) => {
     entrySats?: number
   }>()
 
-  if (body.pubkey !== CREATOR_PUBKEY) {
+  if (!isCreatorPubkey(body.pubkey)) {
     return c.json({ error: 'Only the creator can create tournaments' }, 403)
   }
 
@@ -84,7 +83,7 @@ tournamentsRouter.post('/:id/start', async (c) => {
   const tournamentId = c.req.param('id')
   const body = await c.req.json<{ pubkey: string }>()
 
-  if (body.pubkey !== CREATOR_PUBKEY) {
+  if (!isCreatorPubkey(body.pubkey)) {
     return c.json({ error: 'Only the creator can start tournaments' }, 403)
   }