Fix security, stability, and performance quick wins

[Sparksx]

Summary

Comprehensive analysis of the codebase across security, stability, performance, and functionality. This PR implements the highest-priority quick wins (low difficulty, high impact).

Security

• Server-side gold validation: The PUT /api/game/state endpoint now rejects client gold increases exceeding 500 above the server-known balance, logging anomalies. Prevents players from setting arbitrary gold via modified clients.
• Rate-limit refresh token endpoint: /api/auth/refresh now uses the same authLimiter as login/register (5 req/min), preventing brute-force token rotation.
• Atomic username change: Removed the check-then-act race in POST /api/auth/change-username — now relies on the DB unique constraint and catches P2002 directly.

Stability

• Remove competing SIGTERM handler: server/lib/prisma.js had its own SIGTERM/SIGINT handler that could call process.exit(0) before server/index.js finishes draining HTTP connections. Removed the duplicate.
• Guard null user after OAuth retry: If all 3 username-collision retries fail on Discord/Google signup, the code now returns a 409 instead of crashing on null.id.
• try/catch on chat:share-combat: The socket handler had no error handling — an async resolveChannel failure became an unhandled rejection. Now caught and reported to the client.
• Fix event listener leak: home.js registered a CHAT_UPDATED listener on every render() call without removing the old one. Now does off before on.
• Health check verifies DB: /api/health now runs SELECT 1 and returns 503 if the database is unreachable, so Railway won't route traffic to a node with a dead DB.

Performance

• Cache-Control headers: Added public, max-age=3600 to monster templates, sprites, and payment packs endpoints (matching the existing equipment/player template endpoints).
• Static asset caching: Vite hashed assets (/assets/*) now served with max-age=30d, immutable; other static files get max-age=1h.
• Missing DB indexes: Added indexes on User.isGuest, Clan.ownerId, and a unique constraint on Purchase.stripePaymentId (used by refund webhook lookups).

Observability

• Save failure toast: When the debounced server save fails, a SAVE_FAILED event now fires and shows a user-facing toast ("Progress save failed — retrying…") instead of silently logging to console.

Test plan

• All 524 tests pass (npm test)
• Lint clean — 0 errors (npm run lint)
• Production build succeeds (npm run build)
• Verify gold validation: attempt to set gold > current + 500 via modified client → should be rejected
• Verify health check: stop DB → GET /api/health returns 503
• Verify OAuth signup: simulate P2002 exhaustion → returns 409

---

Generated by Claude Code