Take updates from trevato/cs #367

This merges trevato/cs main (3118dc1, staged at refs/following/main). The merge commit (b14d420) keeps this repository's tree for every conflicted file. The one upstream change this repo was missing, #218, is rebuilt on this schema in its own commit (2nd commit) so it can be reviewed alone.

The git merge base is still #179: #361 was squashed, so git doesn't know it already took #212, #214 and #217. So the eight "new" upstream commits split into ones already here and ones that still needed a decision.

Per file:

• This side won in src/client/{hud,world,main,motion,weapons}.ts and their tests, plus src/pages/game.ts and game.test.ts.

- #212 (kill mark), #214 (the gun's raise) and #217 (reduced motion) were rebuilt on the engine in #361. The upstream side of those conflicts is the pre-extraction version of the same work. - Upstream #202 (switching weapons is instant) is this repo's #269, whose deploy times are in weapons.ts. - Upstream #188 (the plant names its place) is already met: this repo's plant line says The bomb has been planted at A. Upstream uses placeAt for this, and there is no placeAt here; callouts wait on #323.

• This side won in src/client/{input,renderer,settings,earshot,plan}.ts and their tests, plus src/readme.test.ts: they stay deleted.

- input and renderer live in src/engine/ (controls.ts, renderer.ts), where other games import them. The parent's edits to them are #198, #214 and #217, all covered above or below. - plan.ts was replaced by src/plan/. Upstream #222's worthTheDetour is a pure function for the parent's bot planner, which this repo doesn't have, so here it would have no caller. It is left out, not ported as dead code. - Upstream's settings.ts saves Motion. #361 chose to read menu fields at match start and save none of them, and that choice stands.

• Upstream's src/client/zoom.ts and zoom.test.ts (#198): dropped. Scoped sensitivity already lives in this repo's src/client/look.ts (#231), so this would be a second copy of the same rule.
• README.md: this side, plus one paragraph for the standings change.
• src/db.ts and src/db.test.ts: this side, with upstream #218 rebuilt on this repo's schema.

- Upstream keys the board by identity. Here it is keyed by (user_id, name), because this repository groups guests by name. - saveMatch and deleteMatch recompute only the row of the player they touched, inside a transaction. A post that renames a match recomputes both the old row and the new one. - An older database builds the standing table once when it opens. - Two things I found while porting: - The recompute needs a new match_by_player (user_id, name) index. Without it every save scans the whole match table, and 20,000 saves took 16 s. - The old GROUP BY broke ties by player without saying so, and src/server.test.ts depended on that order. The tie-break is now explicit in both the query and the index. No existing test was changed. - At 20,000 matches, standings drops from 13.9 ms to 0.2 ms. - Four new tests cover: - building the table from an older database - a later post, a rename and a delete, each moving the right row - a refused post leaving the board untouched - a read-time bound, measured as the median of seven reads

bun run test passed twice in a row, 1474 of 1474. During debugging, one full run had src/range/boot.test.ts fail once; that code isn't touched here, and it passed in both final runs. The booted app answers / in 22 ms. To try it in the preview, finish a match and check that the All time table on / shows it, the same as before.

Closes #362

🤖 Generated with Claude Code

Closes #362