Fix bullet/ship desync; rework death, escape, arrival and hub awareness

(1) Bullets appeared to trail the ship. Two independent causes, measured with
the new tools/diag_prediction.gd rather than guessed at:
  - ServerRuntime ticked before ClientRuntime, so input sampled on frame N was
    not consumed until frame N+1, leaving the drawn ship a constant one tick
    (4.00px at 240 u/s) ahead of the authoritative one that bullets spawn from.
    ClientRuntime now sets process_physics_priority = -10. Gap on a listen
    server: 4.00px -> 0.10px mean, 0.30px worst.
  - PLAYER_MUZZLE_OFFSET was PLAYER_RADIUS + 6 = 12px against a 13px drawn
    ship, so bullets were born inside the sprite. Regression from the previous
    commit's hitbox shrink; it now derives from PLAYER_VISUAL_RADIUS.

(2) No more timed respawn. A downed player stays down until they ask for the
hub (E), which is an ordinary input -- the server has no "revive me" message.

(3) Escape channel 3s -> 1s, and damage no longer cancels it. An interruptible
channel makes killing the process strictly better than using the button, so a
dropped connection now runs the same channel: the player stays in the world as
linkdead, still killable, and is only released once it completes. Instances
refuse to close while a linkdead body is resolving, or a solo drop would delete
it on the next tick and hand the exploit straight back.

(4) Escape opens an in-game menu: return to hub (routed through the same held-
escape channel, not a new message), disconnect, quit.

(5) Server pushes a roster so the hub shows who is online and which dungeon
they are in. Entering a dungeon grants 2s arrival protection -- invulnerable
AND weapons-cold, since invulnerability alone would make the spawn a free
firing position -- flagged in the snapshot and drawn on every protected ship.

(6) Cleared dungeons hold the party 30s (was 5s) with a visible countdown.

(7) The hub's grey circle was a 100k-HP target dummy that read as scenery. Now
drawn as a bullseye so its purpose is legible.

Protocol version 1 -> 2. 91 tests (was 78); smoke.sh gains a bot that is
SIGKILLed mid-dungeon to prove the disconnect path end to end. check.sh,
test.sh and smoke.sh all pass.

src/ui/game_menu.gd

@@ -0,0 +1,103 @@
+extends CanvasLayer
+## In-game system menu, opened with Escape.
+##
+## Exists because without it there is no way out of a session short of killing
+## the process -- and "kill the process" is exactly the behaviour the escape
+## channel is designed to discourage, so leaving it as the only exit would work
+## against the rest of the design.
+
+signal resumed
+signal return_to_hub_requested
+signal disconnect_requested
+
+var _panel: VBoxContainer
+var _hub_button: Button
+var _open: bool = false
+
+
+func _ready() -> void:
+	layer = 20
+	var root := Control.new()
+	root.set_anchors_and_offsets_preset(Control.PRESET_FULL_RECT)
+	add_child(root)
+
+	# Dim the game behind the menu so it is obvious the world is still running.
+	var scrim := ColorRect.new()
+	scrim.color = Color(0.0, 0.0, 0.0, 0.55)
+	scrim.set_anchors_and_offsets_preset(Control.PRESET_FULL_RECT)
+	scrim.mouse_filter = Control.MOUSE_FILTER_STOP
+	root.add_child(scrim)
+
+	var center := CenterContainer.new()
+	center.set_anchors_and_offsets_preset(Control.PRESET_FULL_RECT)
+	root.add_child(center)
+
+	_panel = VBoxContainer.new()
+	_panel.custom_minimum_size = Vector2(320.0, 0.0)
+	_panel.add_theme_constant_override("separation", 10)
+	center.add_child(_panel)
+
+	var title := Label.new()
+	title.text = "PAUSED"
+	title.add_theme_font_size_override("font_size", 26)
+	_panel.add_child(title)
+
+	var note := Label.new()
+	note.text = "The world keeps running. You are not safe here."
+	note.add_theme_font_size_override("font_size", 12)
+	note.add_theme_color_override("font_color", Color(1.0, 0.7, 0.5))
+	_panel.add_child(note)
+
+	_hub_button = _button("Return to hub", func() -> void:
+		return_to_hub_requested.emit()
+		close())
+	_button("Resume", func() -> void: close())
+	_button("Disconnect to menu", func() -> void:
+		disconnect_requested.emit()
+		close())
+	_button("Quit game", func() -> void: get_tree().quit())
+
+	visible = false
+
+
+func _button(text: String, on_press: Callable) -> Button:
+	var b := Button.new()
+	b.text = text
+	b.pressed.connect(on_press)
+	_panel.add_child(b)
+	return b
+
+
+func _unhandled_input(event: InputEvent) -> void:
+	if event.is_action_pressed("system_menu"):
+		toggle()
+		get_viewport().set_input_as_handled()
+
+
+func toggle() -> void:
+	if _open:
+		close()
+	else:
+		open()
+
+
+func open() -> void:
+	_open = true
+	visible = true
+	# Nothing is paused -- the server does not stop for one client's menu, so
+	# neither does the view. Only the mouse is freed.
+	Input.mouse_mode = Input.MOUSE_MODE_VISIBLE
+
+
+func close() -> void:
+	_open = false
+	visible = false
+
+
+func is_open() -> bool:
+	return _open
+
+
+## The hub button is meaningless when you are already in the hub.
+func set_in_dungeon(in_dungeon: bool) -> void:
+	_hub_button.disabled = not in_dungeon