The bomb's blast: a lethal core, falloff, armour, and a death the kill feed can name #49

When the bomb goes off, world.ts (the bomb_timeout branch, ~693) kills everyone within 1000 units outright: p.health = 0, no falloff, no armour, no cover, and nobody credited. de_forge is 44×128 = 5632 units across, so that circle is roughly a fifth of the map — a terrorist standing on 100 HP with kevlar behind two walls 990 units away dies exactly as the CT lying on top of the bomb does. #44 deliberately left this alone as a separate argument; this is that argument.

Done looks like:

• [ ] A lethal core — everything inside it dies — and damage falling to zero at the edge of the blast, as a pure function of distance so it can be checked in a test without a world.
• [ ] Armour reduces it the way applyHit reduces a bullet, so kevlar is worth buying on a round you might lose to the clock. Walls do not — the bomb ignores cover in CS and it should here; say so in the comment so nobody "fixes" it later.
• [ ] The damage goes through the same path every other point of damage does: the person gets a hurt effect (so the vignette, the flinch and the pain sound all work), the kill feed can name the bomb as what killed you, the corpse is still added, and whatever ledger #39 lands reads it without special-casing.
• [ ] Surviving is possible: a player far enough out ends the round alive on low health, and the round still ends detonated with the terrorists paid exactly as they are today.
• [ ] Tests in world.test.ts: a player on the bomb dies; one at the edge takes nothing; one in between takes less with armour than without; a player behind a wall still takes it; the round's winner, reason and rewards are unchanged; and a survivor is still alive when the next round starts.
• [ ] bun test green, README's What is real says what the blast does.

Not in this issue: the planter earning kills for it (CS does not credit them either), a shockwave in the renderer, and the explosion's sound — that is #44.

Files I expect to change: src/client/world.ts (and combat.ts if the armour arithmetic belongs beside applyHit), world.test.ts, README.md.

Risks: this is inside the bomb_timeout event, the same handful of lines #44 edits to push the explode sound — hence the dependency. The RL arena steps this event too: the loop is over ten players once per detonation, so keep it arithmetic and allocate nothing, and do not touch observe.ts.

Who: vesper — simulation and damage.

Written before #36 merged (pull #47). It now has a neighbour to follow rather than invent: src/client/grenades.ts exports blastDamage and armorSplit is in weapons.ts, so the bomb's falloff should be the same function the HE uses with the bomb's own radius and centre damage — one blast rule in the repository, not two. GRENADE.blastRadius is 350 for a grenade; the bomb's is a different number, not a different idea.

Unblocked: #44 landed as pull #57, so src/client/cues.ts and the explode sound exist and the bomb_timeout branch has already been edited once. Two things to inherit rather than invent — the sound is pushed there already (do not push a second one), and blastDamage from grenades.ts is the falloff to reuse with the bomb's own radius. The one difference from the grenade stays as written in this issue: the HE requires visible(...) eye-to-blast and the bomb does not.