feat: omni-morph sprite swap, bullet time showboats, music tuning, server hardening

- Creator omni-morph now generates actual sprite sheets for morphed archetypes
- 3 new Creator showboats: bullet time attack, ₿ throne summon, disco dance
- Music: subtle tempo shift (+10 BPM max), longer phrases (8/16/24 bars),
  smoother crossfades, less chaotic hi-hat at high intensity
- Server: security headers, body size limit, production error masking,
  CORS origin warning, graceful shutdown with drain
- Payments: atomic consume (eliminates SELECT/UPDATE race), release reverts DB
- Fight loop: round events for live TUI, retro displayPrompt
- Frontend: pass pubkey in payment/queue requests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/engine/orchestrator.ts

@@ -37,6 +37,10 @@ const MAX_RESPONSE_BYTES = 10 * 1024 // 10KB
 // Track bots currently in a fight to prevent concurrent fights
 const activeFighters = new Set<string>()
 
+export function getActiveFighterCount(): number {
+  return activeFighters.size
+}
+
 export function isInFight(botId: string): boolean {
   return activeFighters.has(botId)
 }
@@ -384,7 +388,7 @@ async function executeFightRounds(fightId: string, botA: BotRecord, botB: BotRec
       fightId,
       roundNumber: round,
       challengeType: challenge.type,
-      challengeData: JSON.stringify({ prompt: challenge.prompt, scoring: challenge.scoring, retroKnown: challenge.type === 'retro_mode' ? challenge.answers : undefined }),
+      challengeData: JSON.stringify({ prompt: challenge.prompt, displayPrompt: challenge.displayPrompt, scoring: challenge.scoring, retroKnown: challenge.type === 'retro_mode' ? challenge.answers : undefined }),
       botAResponse: responseA.answer,
       botATimeMs: responseA.timeMs,
       botAScore: result.botAScore,