Fix bullet/ship desync; rework death, escape, arrival and hub awareness

(1) Bullets appeared to trail the ship. Two independent causes, measured with
the new tools/diag_prediction.gd rather than guessed at:
  - ServerRuntime ticked before ClientRuntime, so input sampled on frame N was
    not consumed until frame N+1, leaving the drawn ship a constant one tick
    (4.00px at 240 u/s) ahead of the authoritative one that bullets spawn from.
    ClientRuntime now sets process_physics_priority = -10. Gap on a listen
    server: 4.00px -> 0.10px mean, 0.30px worst.
  - PLAYER_MUZZLE_OFFSET was PLAYER_RADIUS + 6 = 12px against a 13px drawn
    ship, so bullets were born inside the sprite. Regression from the previous
    commit's hitbox shrink; it now derives from PLAYER_VISUAL_RADIUS.

(2) No more timed respawn. A downed player stays down until they ask for the
hub (E), which is an ordinary input -- the server has no "revive me" message.

(3) Escape channel 3s -> 1s, and damage no longer cancels it. An interruptible
channel makes killing the process strictly better than using the button, so a
dropped connection now runs the same channel: the player stays in the world as
linkdead, still killable, and is only released once it completes. Instances
refuse to close while a linkdead body is resolving, or a solo drop would delete
it on the next tick and hand the exploit straight back.

(4) Escape opens an in-game menu: return to hub (routed through the same held-
escape channel, not a new message), disconnect, quit.

(5) Server pushes a roster so the hub shows who is online and which dungeon
they are in. Entering a dungeon grants 2s arrival protection -- invulnerable
AND weapons-cold, since invulnerability alone would make the spawn a free
firing position -- flagged in the snapshot and drawn on every protected ship.

(6) Cleared dungeons hold the party 30s (was 5s) with a visible countdown.

(7) The hub's grey circle was a 100k-HP target dummy that read as scenery. Now
drawn as a bullseye so its purpose is legible.

Protocol version 1 -> 2. 91 tests (was 78); smoke.sh gains a bot that is
SIGKILLed mid-dungeon to prove the disconnect path end to end. check.sh,
test.sh and smoke.sh all pass.

src/ui/hud.gd

@@ -68,9 +68,11 @@ func _status_text() -> String:
 func _hint_text() -> String:
 	if client == null:
 		return ""
+	if not client.my_alive:
+		return "DOWN   --   press E to return to the hub"
 	if client.instance_kind == Protocol.InstanceKind.LOBBY:
-		return "WASD move   mouse aim   LMB fire   E on the ring to enter a dungeon"
-	return "WASD move   mouse aim   LMB fire   hold F to escape to the lobby"
+		return "WASD move   mouse aim   LMB fire   E on the ring to enter a dungeon   Esc menu"
+	return "WASD move   mouse aim   LMB fire   hold F to return to the hub   Esc menu"
 
 
 func _draw_hud() -> void:
@@ -89,16 +91,64 @@ func _draw_hud() -> void:
 
 	_draw_boss_bar()
 
+	if client.my_spawn_grace:
+		_canvas.draw_string(ThemeDB.fallback_font,
+			origin + Vector2(BAR_W + 12.0, BAR_H),
+			"ARRIVING -- invulnerable, weapons cold",
+			HORIZONTAL_ALIGNMENT_LEFT, -1, 14, Color(0.6, 0.9, 1.0))
+
+	_draw_cleared_countdown()
+	_draw_roster()
+
 	if not client.my_alive:
-		var size := _canvas.size
-		_canvas.draw_string(ThemeDB.fallback_font, size * 0.5 - Vector2(70.0, 0.0),
-			"DOWN -- respawning", HORIZONTAL_ALIGNMENT_LEFT, -1, 22, Color(1.0, 0.4, 0.4))
+		# Centred on the canvas, which is only correct because _canvas actually
+		# has the viewport's size now -- see the anchor note in _ready().
+		var centre := _canvas.size * 0.5
+		_canvas.draw_string(ThemeDB.fallback_font, centre - Vector2(52.0, 8.0),
+			"DOWN", HORIZONTAL_ALIGNMENT_LEFT, -1, 34, Color(1.0, 0.4, 0.4))
+		_canvas.draw_string(ThemeDB.fallback_font, centre - Vector2(118.0, -18.0),
+			"press E to return to the hub", HORIZONTAL_ALIGNMENT_LEFT, -1, 16,
+			Color(1.0, 0.75, 0.75))
 
 	if _hit_flash > 0.0:
 		_canvas.draw_rect(Rect2(Vector2.ZERO, _canvas.size),
 			Color(1.0, 0.2, 0.25, 0.18 * _hit_flash))
 
 
+## Shown after the boss dies, so the victory lap has a visible clock on it.
+func _draw_cleared_countdown() -> void:
+	if client.cleared_countdown >= Protocol.COUNTDOWN_NONE:
+		return
+	var text := "DUNGEON CLEARED  --  returning to the hub in %ds" % client.cleared_countdown
+	_canvas.draw_string(ThemeDB.fallback_font,
+		Vector2(_canvas.size.x * 0.5 - 190.0, _canvas.size.y * 0.5 - 60.0),
+		text, HORIZONTAL_ALIGNMENT_LEFT, -1, 18, Color(0.6, 1.0, 0.75))
+
+
+## Who else is online, and whether they are already in a dungeon. Only useful in
+## the hub, which is the one place you are deciding whether to go in.
+func _draw_roster() -> void:
+	if client.instance_kind != Protocol.InstanceKind.LOBBY or client.roster.is_empty():
+		return
+	var x := _canvas.size.x - 240.0
+	var y := MARGIN + 4.0
+	_canvas.draw_string(ThemeDB.fallback_font, Vector2(x, y), "ONLINE",
+		HORIZONTAL_ALIGNMENT_LEFT, -1, 13, Color(0.65, 0.7, 0.8))
+	y += 20.0
+	for entry in client.roster:
+		var in_dungeon: bool = int(entry["kind"]) == Protocol.InstanceKind.DUNGEON
+		var where := "dungeon %d" % int(entry["instance"]) if in_dungeon else "hub"
+		var col := Color(1.0, 0.7, 0.45) if in_dungeon else Color(0.7, 0.8, 0.9)
+		if not entry["alive"]:
+			col = Color(0.85, 0.4, 0.4)
+			where += " (down)"
+		var me := "  <- you" if int(entry["peer"]) == client.my_peer else ""
+		_canvas.draw_string(ThemeDB.fallback_font, Vector2(x, y),
+			"%s  --  %s%s" % [entry["name"], where, me],
+			HORIZONTAL_ALIGNMENT_LEFT, -1, 13, col)
+		y += 18.0
+
+
 func _draw_boss_bar() -> void:
 	var b := client.boss_state()
 	if b.is_empty() or client.boss_def == null: