A match you can play again: the id is a thing you can paste, and you get the same map, seed and bots #173

Once a match is reproducible from its id (#170), the id stops being bookkeeping and becomes the most interesting string in the app — and nothing yet lets a player use it.

Today the id picks the map (generateLevel(seedFrom(matchId))) and, after #170, the simulation seed too. So a match is fully described by one short string: same layout, same spawns, same bot skills, same seed. Handing that string back to a player is a rematch, a challenge to a friend, and the thing a bug report needs.

Waits for #170.

Done looks like

• [ ] The menu can start a match from an id a person types or pastes, validated at the boundary — the same shape src/result.ts already accepts for a match id, nothing else — and an invalid one falls back to a fresh match with a visible word, never an error page.
• [ ] / accepts ?match=<id> and preselects it; the server validates and escapes it, and the client validates it again.
• [ ] The id of the match you are playing is on the screen where a person can copy it — with the map's name — and there is a copy-the-link control that is a real <a href> a keyboard can reach and a thumb can hit.
• [ ] Playing the same id twice gives the same map, the same bots and the same seed. A test asserts it end to end: two worlds created from one id fold to the same digest through the engine's digest door after a fixed script of ticks.
• [ ] A rematch is a new row on the leaderboard, not an overwrite: the stored match id stays unique per played match, and the pull says how it distinguishes them.
• [ ] Nothing changes for a player who never touches it: no id, fresh match, exactly as today.

Files I expect to change

src/client/main.ts, src/pages/game.ts, src/server.ts (the query), src/client/main.test.ts, src/server.test.ts, static/app.<hash>.js.

Risks

• A pasted id is an input. Validate on the server, escape it in the markup, validate again in the page — and never let it reach generateLevel unchecked.
• #148 does the same job for the map alone. Whichever lands second should fold the two controls into one honest choice rather than leaving a menu with two ways to say the same thing.

Suggested: Torque — a state reproduced from a URL is the brief.