feat: human vs AI mode — live typing challenges, baby growth system, SSE rounds

- Add choose-mode step: "I BUILD BOTS" vs "I FIGHT MYSELF" paths
- Human registration with baby avatar picker, no webhook required
- Live fight scene with SSE round streaming and real-time challenge UI
- 5-second timer per round, submit answers via browser
- Baby → toddler → kid → teen → adult → hero → super growth stages
- Huge sparkly baby eyes, diapers, pacifiers, bibs, rattles, rosy cheeks
- Speech bubble positioning fix (pushed to outside of sprite)
- Canvas text rendering via offscreen canvas to bypass kaplay color issues
- Voice timing improvements: await pauses between voice lines and hits
- 30 devastating announcement lines, 15 critical/hit word variants
- Orchestrator human player detection + waitForHumanResponse system
- Server endpoints: GET /challenge/:botId, POST /respond/:botId
- Human player auth: register-human route, isHuman flag on login

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/auth.ts

@@ -40,10 +40,17 @@ authRouter.post('/login', async (c) => {
   }
 
   const bot = rows[0]
+
+  // Check if this is a human player by loading webhookUrl
+  const webhookRows = await db.select({ webhookUrl: schema.bots.webhookUrl })
+    .from(schema.bots).where(eq(schema.bots.id, bot.id)).limit(1)
+  const isHuman = webhookRows[0]?.webhookUrl === 'http://human.local/'
+
   return c.json({
     exists: true,
     bot: {
       ...bot,
+      isHuman,
       customization: bot.customization ? JSON.parse(bot.customization) : null,
     },
   })
@@ -147,6 +154,69 @@ authRouter.post('/register', rateLimit(3600_000, 5), async (c) => {
   }, 201)
 })
 
+
+// Register a human player (no webhook required)
+authRouter.post('/register-human', rateLimit(3600_000, 5), async (c) => {
+  const body = await c.req.json()
+  const { pubkey, name, profilePicUrl, avatarSeed } = body
+
+  if (!pubkey || typeof pubkey !== 'string' || pubkey.length !== 64) {
+    return c.json({ error: 'Invalid pubkey.' }, 400)
+  }
+
+  if (!name || typeof name !== 'string' || name.length < 2 || name.length > 32) {
+    return c.json({ error: 'Name must be 2-32 characters.' }, 400)
+  }
+
+  if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
+    return c.json({ error: 'Name must be alphanumeric, hyphens, or underscores.' }, 400)
+  }
+
+  const normalizedName = name.toLowerCase()
+
+  const existingPk = await db.select({ id: schema.bots.id })
+    .from(schema.bots)
+    .where(eq(schema.bots.publicKey, pubkey))
+    .limit(1)
+
+  if (existingPk.length > 0) {
+    return c.json({ error: 'This Nostr key already has a fighter.' }, 409)
+  }
+
+  const existingName = await db.select({ id: schema.bots.id })
+    .from(schema.bots)
+    .where(eq(sql`LOWER(${schema.bots.name})`, normalizedName))
+    .limit(1)
+
+  if (existingName.length > 0) {
+    return c.json({ error: 'That name is already taken.' }, 409)
+  }
+
+  const id = nanoid(12)
+  const secret = randomBytes(32).toString('hex')
+
+  await db.insert(schema.bots).values({
+    id,
+    name: normalizedName,
+    webhookUrl: 'http://human.local/',
+    avatarSeed: avatarSeed || normalizedName,
+    archetype: 'human',
+    secretHash: createHash('sha256').update(secret).digest('hex'),
+    publicKey: pubkey,
+    profilePicUrl: profilePicUrl || null,
+    customization: null,
+    createdAt: new Date().toISOString(),
+  })
+
+  return c.json({
+    id,
+    name: normalizedName,
+    archetype: 'human',
+    isHuman: true,
+    message: 'Human fighter registered.',
+  }, 201)
+})
+
 // Update bot webhook and/or customization (requires pubkey match)
 authRouter.post('/update', async (c) => {
   const body = await c.req.json()

server/src/routes/fights.ts

@@ -8,6 +8,7 @@ import { startFightLoop } from '../engine/fight-loop.js'
 import { runFight, runFightAsync, isInFight } from '../engine/orchestrator.js'
 import { fightEvents } from '../engine/events.js'
 import { botRateLimit } from '../middleware/rate-limit.js'
+import { getPendingChallenge, submitHumanResponse } from '../engine/human-responses.js'
 
 export const fightsRouter = new Hono()
 
@@ -221,6 +222,45 @@ fightsRouter.post('/matchmake/:botId', botRateLimit(10_000), async (c) => {
   })
 })
 
+// Get pending challenge for a human player in an active fight
+fightsRouter.get('/:fightId/challenge/:botId', async (c) => {
+  const fightId = c.req.param('fightId')
+  const botId = c.req.param('botId')
+
+  const challenge = getPendingChallenge(fightId, botId)
+  if (!challenge) {
+    // Check if fight is still active
+    const fight = await db.select({ status: schema.fights.status })
+      .from(schema.fights)
+      .where(eq(schema.fights.id, fightId))
+      .limit(1)
+
+    const status = fight[0]?.status || 'unknown'
+    return c.json({ pending: false, fightStatus: status })
+  }
+
+  return c.json({ pending: true, ...challenge })
+})
+
+// Submit human response to a challenge
+fightsRouter.post('/:fightId/respond/:botId', async (c) => {
+  const fightId = c.req.param('fightId')
+  const botId = c.req.param('botId')
+  const body = await c.req.json()
+
+  const { answer, trashTalk } = body
+  if (!answer || typeof answer !== 'string') {
+    return c.json({ error: 'Answer is required.' }, 400)
+  }
+
+  const accepted = submitHumanResponse(fightId, botId, answer, trashTalk)
+  if (!accepted) {
+    return c.json({ error: 'No pending challenge found. May have timed out.' }, 404)
+  }
+
+  return c.json({ accepted: true })
+})
+
 // SSE stream for live fight events
 fightsRouter.get('/:id/stream', (c) => {
   const fightId = c.req.param('id')