Add multiplayer bots, typing languages, and rework the UI layout

Multiplayer
- Quick match: POST /api/multiplayer/quickmatch returns whichever room is
  still filling, or opens one. Players never see a room code; joining by
  code stays for racing specific people.
- Bots fill quick-match rooms after a short wait so a new game is never an
  empty lobby. They only ever join quick-match rooms, never a room opened
  by code. One or two per room, drawn from separate ~40 and ~80 WPM tiers so
  two bots are never near each other's pace, and they stall to correct
  mistakes rather than typing a clean straight line.
- Live player count via GET /api/multiplayer/online, shown on the
  Multiplayer control and under the main menu's Multiplayer button.
- Per-racer colours: you are the theme accent, opponents take distinct hues
  that stay the same from lobby to race.
- The countdown no longer holds the room lock for its full three seconds,
  which is what reset clients mid-countdown.

Typing languages
- 16 languages for the generated-word modes, each with its own
  high-frequency vocabulary rather than a translation of the English list.
- Picker in the top-right rail; non-English uses its own list at every
  difficulty tier instead of falling back to English words.

Fix UTF-8 accuracy in the game core
- update_game_state mixed byte and character counts: total_characters_typed
  accumulated byte-length deltas while total_correct_characters compared a
  char index against that byte count. Equal on ASCII, so it went unnoticed;
  a correctly typed Spanish passage scored 6%. The old byte slicing would
  also have panicked if an index landed inside a multi-byte character.
  Rewritten char-based, with regression tests.

Programming mode
- Replaced prose about programming with real code: 26 syntax-highlighted
  snippets across JavaScript, Python, Rust, C/Go/Java and shell. Single-line
  by necessity, since the typing input is a single-line field.

Layout and readability
- One icon rail arrangement on every screen: Settings/Store under the
  wordmark, Language/Theme/Friends/Account top-right, Stats/Leaderboard/
  Multiplayer bottom-right.
- Main menu: mode picker moved out of the Single Player button, which it was
  notching a divider through and pushing the label off-centre.
- Escape returns to the menu, closing any open popover first, and confirms
  before abandoning a live race.
- Split --text-color and --sub-color per theme; they shared one value that
  measured 3.65:1 against the background, below the 4.5:1 body-text floor.
- Semantic colours used in exactly one place each: gold for a personal best,
  amber for the race countdown and the mobile-result badge.
- Passage now sits in the same place on the typing and end screens, and its
  column is a whole number of characters wide so wrapping cannot leave a
  permanent gap on the right.
- End screen: keystrokes and a correct/wrong/extra/missed split, attribution
  carried over from the typing screen, and a graph with a separate error
  axis, axis titles including seconds, and smoothed lines.

1 files changed, 61 insertions, 0 deletions

diff --git a/web/src/counts.js b/web/src/counts.js
new file mode 100644
index 0000000..1b98bbe
--- /dev/null
+++ b/web/src/counts.js
@@ -0,0 +1,61 @@
+import { api } from './api.js';
+import { getOnlineCount } from './multiplayer.js';
+import { getUser, onAuthChange } from './auth.js';
+
+// Live counts for the badges on the Friends and Multiplayer controls: how
+// many people you can race right now, and how many friends you have.
+//
+// Shared and cached rather than fetched per control. The rail is rebuilt on
+// every screen change, and without this each navigation fired a fresh pair of
+// requests - and the main menu's Multiplayer button would have fired its own
+// on top of that, asking the server the same question twice per screen.
+const REFRESH_MS = 30000;
+
+let cache = { online: 0, friends: 0 };
+const listeners = new Set();
+let timer = null;
+let inFlight = false;
+
+async function refresh() {
+    if (inFlight) return;
+    inFlight = true;
+    try {
+        const online = await getOnlineCount().then(r => r.players).catch(() => cache.online);
+        // Friends only exist for a signed-in user; asking while signed out is
+        // a guaranteed 401, so skip it rather than log noise on every poll.
+        const friends = getUser()
+            ? await api.get('/api/friends').then(r => (r.friends || []).length).catch(() => cache.friends)
+            : 0;
+        cache = { online, friends };
+        for (const fn of listeners) fn(cache);
+    } finally {
+        inFlight = false;
+    }
+}
+
+export function getCounts() {
+    return cache;
+}
+
+// Returns an unsubscribe function. Polling runs only while something is
+// listening, so a screen with no badges costs nothing.
+export function onCountsChange(fn) {
+    listeners.add(fn);
+    if (!timer) {
+        refresh();
+        timer = setInterval(refresh, REFRESH_MS);
+    }
+    return () => {
+        listeners.delete(fn);
+        if (listeners.size === 0 && timer) {
+            clearInterval(timer);
+            timer = null;
+        }
+    };
+}
+
+// Signing in or out changes the friend count immediately - waiting up to the
+// full poll interval would leave a stale badge behind.
+onAuthChange(() => {
+    if (listeners.size > 0) refresh();
+});