feat: omni-morph sprite swap, bullet time showboats, music tuning, server hardening

- Creator omni-morph now generates actual sprite sheets for morphed archetypes
- 3 new Creator showboats: bullet time attack, ₿ throne summon, disco dance
- Music: subtle tempo shift (+10 BPM max), longer phrases (8/16/24 bars),
  smoother crossfades, less chaotic hi-hat at high intensity
- Server: security headers, body size limit, production error masking,
  CORS origin warning, graceful shutdown with drain
- Payments: atomic consume (eliminates SELECT/UPDATE race), release reverts DB
- Fight loop: round events for live TUI, retro displayPrompt
- Frontend: pass pubkey in payment/queue requests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/fight-loop-cli.ts

@@ -79,6 +79,16 @@ async function main() {
       renderer.render()
     },
 
+    onRoundComplete: (data) => {
+      if (state.currentFight) {
+        state.currentFight.round = data.round
+        state.currentFight.botA.hp = data.hp.a
+        state.currentFight.botB.hp = data.hp.b
+        if (data.challengeType) state.currentFight.challengeType = data.challengeType
+        renderer.render()
+      }
+    },
+
     onFightComplete: async (result) => {
       state.completed++