Harden realm continuity and authority boundaries

[ael-dev3]

What changed

• retires stale map gestures when the Realm presentation changes and adds bounded recovery for embedded browser history traversal
• keeps overflow gathering portraits visual-only while preserving one accessible native control lane and refreshing selected keep identity copy in place
• enforces the documented Farcaster Quick Auth issuer lifetime, rejects query-bearing auth mutations, and strengthens server-only route verification
• bounds the invite access-request queue and its administrative reads
• makes exact Worker dispatch retries terminally idempotent after normal completion without disturbing a later canonical assignment
• packages the reviewed changes as Alpha 0.3.29, The Realm Holds, with concise player-facing notes

Why

Interrupted WebView navigation or presentation changes could leave local interaction latches stale. Several authority paths also relied on upstream or operational bounds that were documented but not enforced at the nearest trust boundary. Exact Worker retries after a successful return could fail despite an authoritative receipt, encouraging unnecessary client ambiguity.

Impact

Players receive more reliable touch and embedded navigation, cleaner gathering controls, and fresher public identity presentation. Gateway, admission, and Worker paths fail closed under tighter bounded rules. This patch does not change admission decisions, ownership, balances, gathering rates, terrain, or persistent world data.

Validation

• frontend: 258 files, 2,803 tests (--maxWorkers=2)
• frontend TypeScript project build
• default and GitHub Pages production builds, including runtime asset, production-exclusion, and Farcaster Mini App integrity gates
• auth bridge: 239 Node tests, 9 workerd tests, both typechecks
• SpacetimeDB: 314 tests plus module build
• generated binding verification, Worker/access-request additive proofs, and a full populated v1→v13 deletion-disabled migration replay
• npm/pnpm vulnerability audits: no known vulnerabilities
• 576 registry signatures and 174 attestations verified
• repository secret scan and GitHub Dependabot, CodeQL, and secret-scanning alert review found no open high-risk findings
• license and tracked file-size policies pass

Honest residual risk

The deployed access-request v1 table still lacks an indexed review order. Alpha 0.3.29 prevents unbounded growth and unbounded administrative materialization, but a later additive queue revision should provide indexed pagination before admission opens at materially larger scale. Existing production chunk-size warnings also remain unchanged.