fix: allow Google Fonts in CSP so 3D announcement font loads in production

fontSrc blocked fonts.gstatic.com and styleSrc blocked fonts.googleapis.com,
causing Honk font to fail in production. The chromatic aberration pseudo-elements
then appeared as doubled plain text instead of a styled 3D effect.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/app.ts

@@ -41,10 +41,10 @@ app.use('*', secureHeaders({
   contentSecurityPolicy: process.env.NODE_ENV === 'production' ? {
     defaultSrc: ["'self'"],
     scriptSrc: ["'self'"],
-    styleSrc: ["'self'", "'unsafe-inline'"],
+    styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
     imgSrc: ["'self'", 'data:', 'blob:'],
     connectSrc: ["'self'"],
-    fontSrc: ["'self'"],
+    fontSrc: ["'self'", 'https://fonts.gstatic.com'],
   } : undefined,
 }))
 

server/src/engine/scoring.ts

@@ -1,4 +1,18 @@
-import { ELO_DIVISOR, TIER_THRESHOLDS } from '../lib/constants.js'
+import {
+  ELO_DIVISOR, TIER_THRESHOLDS,
+  TIMEOUT_DAMAGE_MULTIPLIER, CRITICAL_MARGIN_THRESHOLD, CRITICAL_DAMAGE_MULTIPLIER,
+  MARGIN_TO_DAMAGE_SCALE, LOSER_DAMAGE_BASE, ARENA_DAMAGE_MULTIPLIER,
+  MAX_COMBO_STACKS, COMBO_DAMAGE_PER_STACK,
+  FACTUAL_FASTER_BASE, FACTUAL_SLOWER_BASE, SPEED_ADVANTAGE_MULTIPLIER, SPEED_RATIO_MULTIPLIER,
+  ONE_CORRECT_WINNER_BASE, CONFIDENCE_BONUS, NO_ANSWER_SCORE, BOTH_WRONG_FASTER, BOTH_WRONG_SLOWER,
+  EMPTY_RESPONSE_QUALITY, MIN_QUALITY_LENGTH, SPAM_CHAR_RATIO,
+  QUALITY_LENGTH_IDEAL_MIN, QUALITY_LENGTH_IDEAL_MAX, QUALITY_LENGTH_SECONDARY_MAX,
+  QUALITY_SCORE_IDEAL, QUALITY_SCORE_SECONDARY, QUALITY_SCORE_LONG,
+  WORD_DIVERSITY_SCALE, WORD_DIVERSITY_CAP, SPEED_BONUS_BASE,
+  RETRO_SPEED_BONUS_CAP,
+  LARGE_WIN_MARGIN, CLOSE_MATCH_MARGIN, WHIFF_NARRATION_THRESHOLD,
+  DEFAULT_CHALLENGE_TIMEOUT_MS,
+} from '../lib/constants.js'
 import type { Challenge } from './challenges.js'
 import { pick } from '../lib/utils.js'
 import { checkAnswer } from './answers.js'

server/src/lib/constants.ts

@@ -31,3 +31,46 @@ export const DEFAULT_CHALLENGE_TIMEOUT_MS = 8000
 // --- Fight loop ---
 export const FIGHT_LOOP_INTERVAL_MS = 8000
 export const ELO_MATCHING_RANDOMNESS = 150
+
+// --- Scoring: damage ---
+export const TIMEOUT_DAMAGE_MULTIPLIER = 1.5        // Damage multiplier for timeout/error losses
+export const CRITICAL_MARGIN_THRESHOLD = 4           // Score margin above which a hit is critical
+export const CRITICAL_DAMAGE_MULTIPLIER = 1.5        // Damage multiplied on critical hits
+export const MARGIN_TO_DAMAGE_SCALE = 2              // baseDamage + margin * this
+export const LOSER_DAMAGE_BASE = 0.3                 // Loser gets baseDamage * this - margin
+export const ARENA_DAMAGE_MULTIPLIER = 2             // Damage multiplier when arena modifier matches
+
+// --- Scoring: combo ---
+export const MAX_COMBO_STACKS = 5                    // Combo cap before scaling stops
+export const COMBO_DAMAGE_PER_STACK = 0.2            // Damage increase per combo stack
+
+// --- Scoring: factual ---
+export const FACTUAL_FASTER_BASE = 7                 // Base score: correct + faster
+export const FACTUAL_SLOWER_BASE = 5                 // Base score: correct + slower
+export const SPEED_ADVANTAGE_MULTIPLIER = 2          // Speed advantage scaling
+export const SPEED_RATIO_MULTIPLIER = 1.5            // Speed ratio scaling for slower bot
+export const ONE_CORRECT_WINNER_BASE = 9             // Base score: only answerer correct
+export const CONFIDENCE_BONUS = 0.5                  // Multiplier on confidence for correct answer
+export const NO_ANSWER_SCORE = 1                     // Score when opponent has no/wrong answer
+export const BOTH_WRONG_FASTER = 4                   // Both wrong, faster bot
+export const BOTH_WRONG_SLOWER = 3                   // Both wrong, slower bot
+
+// --- Scoring: creative quality ---
+export const EMPTY_RESPONSE_QUALITY = 0.5            // Quality score for null/empty answers
+export const MIN_QUALITY_LENGTH = 10                 // Below this: minimum quality
+export const SPAM_CHAR_RATIO = 0.1                   // Unique chars / length — below = spam
+export const QUALITY_LENGTH_IDEAL_MIN = 30           // Ideal response length minimum
+export const QUALITY_LENGTH_IDEAL_MAX = 400          // Ideal response length maximum
+export const QUALITY_LENGTH_SECONDARY_MAX = 600      // Secondary length cutoff
+export const QUALITY_SCORE_IDEAL = 4                 // Length score: ideal range
+export const QUALITY_SCORE_SECONDARY = 3             // Length score: 400-600
+export const QUALITY_SCORE_LONG = 2                  // Length score: 600+ or short
+export const WORD_DIVERSITY_SCALE = 4                // Diversity scaling factor
+export const WORD_DIVERSITY_CAP = 3                  // Max diversity bonus
+export const SPEED_BONUS_BASE = 2                    // Max speed bonus
+export const RETRO_SPEED_BONUS_CAP = 0.2             // Retro mode speed bonus cap
+
+// --- Scoring: narration thresholds ---
+export const LARGE_WIN_MARGIN = 5                    // Margin for "big win" narration
+export const CLOSE_MATCH_MARGIN = 3                  // Margin for "close match" narration
+export const WHIFF_NARRATION_THRESHOLD = 2           // Whiff count for narration trigger