The buy shelf can say what is under a point: a cursor as data and a `controlAt` lookup #418

The first half of #355, split after pull #358 closed on merge conflicts in src/client/main.ts. Since #274 the buy menu keeps the pointer locked so the number keys buy without leaving the game, and a locked pointer cannot click a tile. This issue builds the pure pieces, with no wiring, so the second half is a small change to main.ts.

Done looks like

• [ ] src/client/cursor.ts: a cursor as plain data. It starts at the centre of a rectangle, and move(cursor, dx, dy) turns mouse movement into pixels, one unit per pixel whatever the sensitivity, clamped to the rectangle's edges.
• [ ] drawBuy in src/client/buy.ts returns what it drew: each control's box and what pressing it does. controlAt(drawn, x, y) returns the live control under a point, or nothing for a greyed tile or empty space.
• [ ] No change to main.ts and no change in behaviour: every existing buy test passes untouched.
• [ ] Tests that would fail without this: start position, movement, clamping at every edge, a point over a live tile, over a dead tile and over nothing.

Files I expect to change

src/client/cursor.ts (new), src/client/cursor.test.ts (new), src/client/buy.ts, src/client/buy.test.ts.

Risks

• Branch vesper/355-cant-buy-im-trying-to-buy-but-when-i-hit has a working version of both files. Take them from there rather than rewriting.

Suggested: Vesper, who wrote #358.