Take updates from trevato/cs #384

This merges trevato/cs main (894d4f6, staged at refs/following/main) in two commits. bun run test passes: typecheck plus 1562 tests. The app boots, / answers 200, and the response carries both new headers.

• Merge commit (8bad3d9): every conflicted file keeps this repository's version, so the merged tree matches the branch's previous tree exactly.
• Port commit: the one upstream change the last take (#381, up to upstream #231) didn't have. That change is #232, which adds COOP and CORP to every response.

The conflict list is long because each earlier take was squashed into one commit. That leaves upstream 0644e74 as the merge base, so git replays everything since then. Only #232 is new.

Per file:

• This side won in README.md, src/client/{bots,hud,main,motion,report,weapons,world}.ts and their tests, src/db.ts, src/db.test.ts, src/pages/game.ts, src/pages/game.test.ts and src/rl/arena.test.ts. Upstream's text in these files dates from before the engine was pulled out. This repository already has upstream's #188–#231 in its own form (#367, #371, #375, #379, #381). README.md then gets the #232 port below.
• This side won in src/client/{bodies,earshot,input,physics,plan,renderer,settings}.ts, their tests and src/readme.test.ts: they stay deleted. Their work lives in src/engine/ (controls, renderer, physics) and in src/plan/, as #313 and #381 decided.
• Upstream's src/client/zoom.ts and zoom.test.ts stay out. look.ts already handles scoped sensitivity, as #379 and #381 found. Upstream's auto-merged additions to src/client/match.ts and src/rl/arena.ts are dropped for the same reason #381 gave: this repository has no settings store for them to serve.
• src/server.ts and src/server.test.ts: this side's text, with #232 ported in.

- floorWith adds cross-origin-opener-policy: same-origin and cross-origin-resource-policy: same-origin, so every route, error and the 101 room upgrade carries them. - The FLOOR list the tests compare against includes both headers, and the 101 upgrade test checks them. - Upstream's every-response test is rewritten for this server. It covers each game page, the bundle, a match post, 404, cross-site 403, 413, 429 and a 500 from onError. - With either header removed, the new test and the 101 test fail. - The new test sits right after the existing rate-limit test, not where upstream put it. Its flood of posts pushes the "ghost" row out of the recent-matches list that the abandoned-match test reads, so it has to run after that test. No existing test was changed.

• README.md: the src/server.ts entry now spells out the whole security floor, including the two new headers.

To try it in the preview, open any page, the bundle or a JSON endpoint in dev tools: each response shows Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin.

Closes #382

🤖 Generated with Claude Code

Closes #382