Security, stability & quality quick wins from codebase audit

[Sparksx]

Summary

Full codebase audit across security, performance, stability, and functionality — this PR implements the highest-priority quick wins (13 fixes across 9 files).

Security (7 fixes)

• Hash refresh tokens (SHA-256) before DB storage — a database leak no longer exposes raw session tokens
• Rate-limit /api/auth/refresh — was the only auth endpoint without the 5/min limiter
• Ban check during login — banned users could previously authenticate and receive tokens via REST (only socket connections checked bans)
• Distinct JWT dev secrets — access and refresh tokens no longer share the same fallback key in development
• Enable Content-Security-Policy via Helmet — was fully disabled (contentSecurityPolicy: false)
• Username character whitelist — restrict to [a-zA-Z0-9_ -] on both register and change-username
• Move one-time pack check inside try/catch in payment route — Prisma errors were unhandled

Stability (2 fixes)

• Remove competing shutdown handlers from prisma.js — it called process.exit(0) before server/index.js could close sockets and HTTP server gracefully
• Wrap clan-leave in a transaction — deleting membership + transferring ownership were separate queries; a crash between them could orphan a clan

Bug fixes (4 fixes)

• Starting gold: 0 → 100 — createDefaultGameState in auth.js used gold: 0 instead of STARTING_GOLD (100), so new registered users started with no gold
• manifest.json theme_color — was #1a1a2e, now matches CSS --bg (#0e0b1a)
• manifest.json description — no longer references "dungeons" (redesigned to arena)
• French error messages in sprites route → English

Cleanup (2 fixes)

• Remove dead shopState destructuring from game state route
• Cache Stripe client as a singleton (was re-created on every payment API call)

Test plan

• All 524 tests pass (npm test)
• Lint clean — 0 errors (npm run lint)
• Build succeeds (npm run build)
• Verify login flow still works (token refresh, guest, OAuth)
• Verify banned user gets 403 on login attempt
• Verify clan leave as owner correctly transfers leadership
• Verify Stripe checkout still works end-to-end

🤖 Generated with Claude Code

https://claude.ai/code/session_01LGK2HsyBdEjDkgY2eCSUDF

---

Generated by Claude Code