feat: human vs AI mode — live typing challenges, baby growth system, SSE rounds

- Add choose-mode step: "I BUILD BOTS" vs "I FIGHT MYSELF" paths
- Human registration with baby avatar picker, no webhook required
- Live fight scene with SSE round streaming and real-time challenge UI
- 5-second timer per round, submit answers via browser
- Baby → toddler → kid → teen → adult → hero → super growth stages
- Huge sparkly baby eyes, diapers, pacifiers, bibs, rattles, rosy cheeks
- Speech bubble positioning fix (pushed to outside of sprite)
- Canvas text rendering via offscreen canvas to bypass kaplay color issues
- Voice timing improvements: await pauses between voice lines and hits
- 30 devastating announcement lines, 15 critical/hit word variants
- Orchestrator human player detection + waitForHumanResponse system
- Server endpoints: GET /challenge/:botId, POST /respond/:botId
- Human player auth: register-human route, isHuman flag on login

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/auth.ts

@@ -40,10 +40,17 @@ authRouter.post('/login', async (c) => {
   }
 
   const bot = rows[0]
+
+  // Check if this is a human player by loading webhookUrl
+  const webhookRows = await db.select({ webhookUrl: schema.bots.webhookUrl })
+    .from(schema.bots).where(eq(schema.bots.id, bot.id)).limit(1)
+  const isHuman = webhookRows[0]?.webhookUrl === 'http://human.local/'
+
   return c.json({
     exists: true,
     bot: {
       ...bot,
+      isHuman,
       customization: bot.customization ? JSON.parse(bot.customization) : null,
     },
   })
@@ -147,6 +154,69 @@ authRouter.post('/register', rateLimit(3600_000, 5), async (c) => {
   }, 201)
 })
 
+
+// Register a human player (no webhook required)
+authRouter.post('/register-human', rateLimit(3600_000, 5), async (c) => {
+  const body = await c.req.json()
+  const { pubkey, name, profilePicUrl, avatarSeed } = body
+
+  if (!pubkey || typeof pubkey !== 'string' || pubkey.length !== 64) {
+    return c.json({ error: 'Invalid pubkey.' }, 400)
+  }
+
+  if (!name || typeof name !== 'string' || name.length < 2 || name.length > 32) {
+    return c.json({ error: 'Name must be 2-32 characters.' }, 400)
+  }
+
+  if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
+    return c.json({ error: 'Name must be alphanumeric, hyphens, or underscores.' }, 400)
+  }
+
+  const normalizedName = name.toLowerCase()
+
+  const existingPk = await db.select({ id: schema.bots.id })
+    .from(schema.bots)
+    .where(eq(schema.bots.publicKey, pubkey))
+    .limit(1)
+
+  if (existingPk.length > 0) {
+    return c.json({ error: 'This Nostr key already has a fighter.' }, 409)
+  }
+
+  const existingName = await db.select({ id: schema.bots.id })
+    .from(schema.bots)
+    .where(eq(sql`LOWER(${schema.bots.name})`, normalizedName))
+    .limit(1)
+
+  if (existingName.length > 0) {
+    return c.json({ error: 'That name is already taken.' }, 409)
+  }
+
+  const id = nanoid(12)
+  const secret = randomBytes(32).toString('hex')
+
+  await db.insert(schema.bots).values({
+    id,
+    name: normalizedName,
+    webhookUrl: 'http://human.local/',
+    avatarSeed: avatarSeed || normalizedName,
+    archetype: 'human',
+    secretHash: createHash('sha256').update(secret).digest('hex'),
+    publicKey: pubkey,
+    profilePicUrl: profilePicUrl || null,
+    customization: null,
+    createdAt: new Date().toISOString(),
+  })
+
+  return c.json({
+    id,
+    name: normalizedName,
+    archetype: 'human',
+    isHuman: true,
+    message: 'Human fighter registered.',
+  }, 201)
+})
+
 // Update bot webhook and/or customization (requires pubkey match)
 authRouter.post('/update', async (c) => {
   const body = await c.req.json()