Build cheffry-s-dungeon #2

This builds the v1 of Cheffry's Dungeon: a live hub, co-op delves for up to 4 players, melee combat with dodge, three enemy types, loot chests, and one seeded dungeon a day with a leaderboard and ghosts. bun test passes (68 tests), bun run lint:design is clean, and the app boots locally. / answered in about 14 ms and the API routes in about 1 ms, with the CSP, nosniff and Referrer-Policy headers set.

• Delve engine (src/sim.ts): each delve is a pure function stepped 20 times a second, with seeded randomness and no imports. The same seed and the same player inputs always produce the same run, which is what makes the server's copy the one that counts and the daily seed fair. It covers:

- melee with reach and cooldown, and a dodge that briefly makes you untouchable; - three enemy behaviours: chase (Meatball Slime), charge (Baguette Knight) and shoot (Pepper Imp); - Skewer Spikes traps and loot chests; - a downed player getting back up when a teammate stands over them; - five rooms per run, with scoring.

• Content as data (content/*.json, checked by src/content.ts): rooms, monsters, traps, loot, tuning numbers and the hub are all JSON. Every file is checked in full at boot, and the app refuses to start on a bad one, naming the field. A new room, or a new monster using an existing behaviour, is a JSON-only change.
• Hub (src/hub.ts, /): only positions, emotes and chat go over the network. A walk is sent once as a target and each client animates it. The page is rendered on the server and updates live over /hub/events.
• Delves (src/delves.ts, /delve/:id): each delve runs in the server's memory. Clients send move, attack, dodge or stop and get game state back over /delves/:id/events. The browser runs the same sim.ts (served as /sim.js) to lay out rooms.
• Daily board and ghosts: finished runs are saved to a new run table under FORGE_APP_DATA. Each run keeps a ghost: the lead player's path, recorded every 10 ticks. Your next party races the day's best ghost on screen.
• Graffiti wall: this is the existing notes feature, shown in the hub.
• Rendering: static/gl.js is a small hand-written WebGL renderer for the low-poly scenes; static/hub.js and static/delve.js are the two clients. No dependencies were added.
• Contract: adds four new resources — avatar, delve, hero and run. note and audit are unchanged and no existing permission is loosened. Every action goes through permit.
• Other doors: the MCP server gains leaderboard and list_delves, and the README now explains how to play, the content files and the networking.

Chose not to do:

• Scaling across processes: all instances run in one process for v1. They share only the database, so splitting them by delve id later is possible but not built.
• Graffiti on the dungeon walls: graffiti stays on the hub wall for now.
• Terminal: src/tty.ts still only handles the graffiti wall; no delve or leaderboard commands there yet.

To try it in the preview:

1. Sign in, then step into the hub on /.
2. Open a table and share its link so friends can join (up to 4).
3. Controls: click to walk, click a monster (or Space/J) to attack, and right-click, Shift or K to dodge.
4. After a run, /api/runs shows today's board.

Files worth reviewing: src/sim.ts, src/actions.ts, contract.json.

🤖 Generated with Claude Code

Closes #1