feat: omni-morph sprite swap, bullet time showboats, music tuning, server hardening

- Creator omni-morph now generates actual sprite sheets for morphed archetypes
- 3 new Creator showboats: bullet time attack, ₿ throne summon, disco dance
- Music: subtle tempo shift (+10 BPM max), longer phrases (8/16/24 bars),
  smoother crossfades, less chaotic hi-hat at high intensity
- Server: security headers, body size limit, production error masking,
  CORS origin warning, graceful shutdown with drain
- Payments: atomic consume (eliminates SELECT/UPDATE race), release reverts DB
- Fight loop: round events for live TUI, retro displayPrompt
- Frontend: pass pubkey in payment/queue requests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/engine/human-responses.ts

@@ -18,6 +18,14 @@ interface PendingChallenge {
 
 const pending = new Map<string, PendingChallenge>()
 
+/** Clear all pending human challenges (used during graceful shutdown) */
+export function clearAllPending(): void {
+  for (const [key, entry] of pending) {
+    clearTimeout(entry.timeoutHandle)
+    pending.delete(key)
+  }
+}
+
 const DEFAULT_HUMAN_TIMEOUT_MS = 8_000
 
 export function isHumanPlayer(webhookUrl: string): boolean {