Add multiplayer bots, typing languages, and rework the UI layout

Multiplayer
- Quick match: POST /api/multiplayer/quickmatch returns whichever room is
  still filling, or opens one. Players never see a room code; joining by
  code stays for racing specific people.
- Bots fill quick-match rooms after a short wait so a new game is never an
  empty lobby. They only ever join quick-match rooms, never a room opened
  by code. One or two per room, drawn from separate ~40 and ~80 WPM tiers so
  two bots are never near each other's pace, and they stall to correct
  mistakes rather than typing a clean straight line.
- Live player count via GET /api/multiplayer/online, shown on the
  Multiplayer control and under the main menu's Multiplayer button.
- Per-racer colours: you are the theme accent, opponents take distinct hues
  that stay the same from lobby to race.
- The countdown no longer holds the room lock for its full three seconds,
  which is what reset clients mid-countdown.

Typing languages
- 16 languages for the generated-word modes, each with its own
  high-frequency vocabulary rather than a translation of the English list.
- Picker in the top-right rail; non-English uses its own list at every
  difficulty tier instead of falling back to English words.

Fix UTF-8 accuracy in the game core
- update_game_state mixed byte and character counts: total_characters_typed
  accumulated byte-length deltas while total_correct_characters compared a
  char index against that byte count. Equal on ASCII, so it went unnoticed;
  a correctly typed Spanish passage scored 6%. The old byte slicing would
  also have panicked if an index landed inside a multi-byte character.
  Rewritten char-based, with regression tests.

Programming mode
- Replaced prose about programming with real code: 26 syntax-highlighted
  snippets across JavaScript, Python, Rust, C/Go/Java and shell. Single-line
  by necessity, since the typing input is a single-line field.

Layout and readability
- One icon rail arrangement on every screen: Settings/Store under the
  wordmark, Language/Theme/Friends/Account top-right, Stats/Leaderboard/
  Multiplayer bottom-right.
- Main menu: mode picker moved out of the Single Player button, which it was
  notching a divider through and pushing the label off-centre.
- Escape returns to the menu, closing any open popover first, and confirms
  before abandoning a live race.
- Split --text-color and --sub-color per theme; they shared one value that
  measured 3.65:1 against the background, below the 4.5:1 body-text floor.
- Semantic colours used in exactly one place each: gold for a personal best,
  amber for the race countdown and the mobile-result badge.
- Passage now sits in the same place on the typing and end screens, and its
  column is a whole number of characters wide so wrapping cannot leave a
  permanent gap on the right.
- End screen: keystrokes and a correct/wrong/extra/missed split, attribution
  carried over from the typing screen, and a graph with a separate error
  axis, axis titles including seconds, and smoothed lines.

1 files changed, 76 insertions, 0 deletions

diff --git a/web/serve.mjs b/web/serve.mjs
new file mode 100644
index 0000000..64d6339
--- /dev/null
+++ b/web/serve.mjs
@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+// Zero-dependency static file server for the TyperPunk web app.
+// Replaces the Vite dev server so the web app has no npm runtime dependency.
+import { createServer } from 'node:http';
+import { readFile, stat } from 'node:fs/promises';
+import { extname, join, normalize, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(fileURLToPath(new URL('.', import.meta.url)));
+const PORT = Number(process.env.PORT) || 4173;
+const HOST = process.env.HOST || '0.0.0.0';
+
+const MIME_TYPES = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.wasm': 'application/wasm',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.ico': 'image/x-icon',
+};
+
+async function resolveFile(urlPath) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(urlPath.split('?')[0]);
+    } catch {
+        return null;
+    }
+    const safePath = normalize(join(ROOT, decoded));
+    if (safePath !== ROOT && !safePath.startsWith(ROOT + sep)) return null;
+
+    let target = safePath;
+    try {
+        const info = await stat(target);
+        if (info.isDirectory()) target = join(target, 'index.html');
+    } catch {
+        return null;
+    }
+
+    try {
+        await stat(target);
+        return target;
+    } catch {
+        return null;
+    }
+}
+
+const server = createServer(async (req, res) => {
+    const filePath = (await resolveFile(req.url)) || (await resolveFile('/index.html'));
+    if (!filePath) {
+        res.writeHead(404, { 'Content-Type': 'text/plain' });
+        res.end('Not found');
+        return;
+    }
+    try {
+        const body = await readFile(filePath);
+        const type = MIME_TYPES[extname(filePath)] || 'application/octet-stream';
+        // This replaces a dev server, and the app is under active
+        // development - no cache headers at all left the browser free to
+        // hold onto old JS/CSS indefinitely with no way to tell it changed,
+        // which has already caused a real "why don't I see the fix" report.
+        res.writeHead(200, { 'Content-Type': type, 'Cache-Control': 'no-cache' });
+        res.end(body);
+    } catch (err) {
+        res.writeHead(500, { 'Content-Type': 'text/plain' });
+        res.end('Internal server error');
+        console.error(err);
+    }
+});
+
+server.listen(PORT, HOST, () => {
+    console.log(`TyperPunk web running at http://localhost:${PORT}`);
+});