A snapshot records the map it was played on: `Saved` gains `map`, validated like every other field #163

Saved now carries map: MapName, written by snapshot() from world.map.name (never from settings) and validated by parseSaved with the same reject-on-anything-else discipline as every other field — wrong type, unknown name, or missing key all yield null.

A snapshot written before this lands has no map key, so parseSaved now refuses it and the menu simply offers no resume — a deliberate one-match cost, not an oversight.

saved.test.ts gains: the round-trip test now carries de_cinder end-to-end, plus a dedicated test asserting null for "de_nonsense", for map: 7, and for a snapshot missing the map key entirely. bun run check (tsc --noEmit && bun test) is clean: 693 pass, 0 fail.

world.ts is untouched — restoreWorld still takes its map parameter, as the issue specifies. Branched from main at b15300e, one file's worth of change (saved.ts + its test), nothing stacked.

Closes #160