Add multiplayer bots, typing languages, and rework the UI layout

Multiplayer
- Quick match: POST /api/multiplayer/quickmatch returns whichever room is
  still filling, or opens one. Players never see a room code; joining by
  code stays for racing specific people.
- Bots fill quick-match rooms after a short wait so a new game is never an
  empty lobby. They only ever join quick-match rooms, never a room opened
  by code. One or two per room, drawn from separate ~40 and ~80 WPM tiers so
  two bots are never near each other's pace, and they stall to correct
  mistakes rather than typing a clean straight line.
- Live player count via GET /api/multiplayer/online, shown on the
  Multiplayer control and under the main menu's Multiplayer button.
- Per-racer colours: you are the theme accent, opponents take distinct hues
  that stay the same from lobby to race.
- The countdown no longer holds the room lock for its full three seconds,
  which is what reset clients mid-countdown.

Typing languages
- 16 languages for the generated-word modes, each with its own
  high-frequency vocabulary rather than a translation of the English list.
- Picker in the top-right rail; non-English uses its own list at every
  difficulty tier instead of falling back to English words.

Fix UTF-8 accuracy in the game core
- update_game_state mixed byte and character counts: total_characters_typed
  accumulated byte-length deltas while total_correct_characters compared a
  char index against that byte count. Equal on ASCII, so it went unnoticed;
  a correctly typed Spanish passage scored 6%. The old byte slicing would
  also have panicked if an index landed inside a multi-byte character.
  Rewritten char-based, with regression tests.

Programming mode
- Replaced prose about programming with real code: 26 syntax-highlighted
  snippets across JavaScript, Python, Rust, C/Go/Java and shell. Single-line
  by necessity, since the typing input is a single-line field.

Layout and readability
- One icon rail arrangement on every screen: Settings/Store under the
  wordmark, Language/Theme/Friends/Account top-right, Stats/Leaderboard/
  Multiplayer bottom-right.
- Main menu: mode picker moved out of the Single Player button, which it was
  notching a divider through and pushing the label off-centre.
- Escape returns to the menu, closing any open popover first, and confirms
  before abandoning a live race.
- Split --text-color and --sub-color per theme; they shared one value that
  measured 3.65:1 against the background, below the 4.5:1 body-text floor.
- Semantic colours used in exactly one place each: gold for a personal best,
  amber for the race countdown and the mobile-result badge.
- Passage now sits in the same place on the typing and end screens, and its
  column is a whole number of characters wide so wrapping cannot leave a
  permanent gap on the right.
- End screen: keystrokes and a correct/wrong/extra/missed split, attribution
  carried over from the typing screen, and a graph with a separate error
  axis, axis titles including seconds, and smoothed lines.

1 files changed, 59 insertions, 0 deletions

diff --git a/web/src/keyStats.js b/web/src/keyStats.js
new file mode 100644
index 0000000..9db0106
--- /dev/null
+++ b/web/src/keyStats.js
@@ -0,0 +1,59 @@
+const STORAGE_KEY = 'typerpunk:keystats';
+// Below this many samples a character's average latency/error rate is too
+// noisy to act on - a key typed twice that happened to be wrong once looks
+// identical to a genuinely hard key without this floor.
+const MIN_SAMPLES = 5;
+
+function load() {
+    try {
+        const raw = JSON.parse(localStorage.getItem(STORAGE_KEY));
+        return raw && typeof raw === 'object' ? raw : {};
+    } catch {
+        return {};
+    }
+}
+
+function save(data) {
+    try { localStorage.setItem(STORAGE_KEY, JSON.stringify(data)); } catch {}
+}
+
+// Called once per typed character (correct or not) with how long it took
+// since the previous keystroke. Skips whitespace - word gaps have highly
+// variable timing for reasons unrelated to how hard a character is to type
+// (thinking about the next word, punctuation pauses), and would otherwise
+// dominate the latency signal for every character adjacent to a space.
+export function recordKeystroke(char, isCorrect, latencyMs) {
+    if (!char || /\s/.test(char)) return;
+    const data = load();
+    const entry = data[char] || { attempts: 0, errors: 0, totalLatency: 0 };
+    entry.attempts += 1;
+    if (!isCorrect) entry.errors += 1;
+    if (latencyMs != null && latencyMs >= 0 && latencyMs < 5000) entry.totalLatency += latencyMs;
+    data[char] = entry;
+    save(data);
+}
+
+// Ranks every character with enough samples by a weak-ness score (error
+// rate weighted heaviest, since a mistake matters more than being merely
+// slow) and returns the worst `limit`. Empty until enough real typing has
+// happened - callers should fall back to plain random text until then.
+export function getWeakChars(limit = 12) {
+    const data = load();
+    const scored = Object.entries(data)
+        .filter(([, e]) => e.attempts >= MIN_SAMPLES)
+        .map(([char, e]) => ({
+            char,
+            errorRate: e.errors / e.attempts,
+            avgLatency: e.totalLatency / e.attempts,
+        }));
+    if (scored.length === 0) return [];
+
+    const maxLatency = Math.max(...scored.map(s => s.avgLatency), 1);
+    scored.forEach(s => { s.score = s.errorRate * 0.7 + (s.avgLatency / maxLatency) * 0.3; });
+    scored.sort((a, b) => b.score - a.score);
+    return scored.slice(0, limit).map(s => s.char);
+}
+
+export function hasEnoughData() {
+    return getWeakChars(1).length > 0;
+}