Remove non-redistributable art from the repo; record licence terms

Researched the licence at each of the four itch.io sources. Two of the four
forbid redistribution, and publishing a repository containing them is exactly
that, so they are out of the tree.

  0x72 DungeonTileset II    CC0 1.0    commercial ok, no credit required
  Helton Yan Pixel Combat   CC BY 4.0  commercial ok, CREDIT REQUIRED
  Fire Pixel Bullet 16x16   custom     non-commercial, NO REDISTRIBUTION
  750+ Effect and FX Pixel  custom     non-commercial, NO REDISTRIBUTION

Both bdragon1727 packs state verbatim: "You cannot do: Resell / redistribute
this asset." The FX pack's paid tier is no better for this purpose -- "You can
NOT re-distribute the file, no matter how much you modify it" -- so paying does
not unlock it and neither does editing the art.

bullets.png and impact.png therefore move to assets/local/, gitignored.
Art.bullets_texture() / impact_texture() load them at runtime and return null
when absent; the bullet renderer falls back to the generated dot it used before,
tinted per kind so bullet types stay distinguishable. Nothing there may be
preload()ed -- preload resolves at compile time and would fail the build on
every machine without the files, which is every clone.

Verified both ways rather than assumed: with the files present the game uses
them and no fallback triggers; with them moved aside, 156/156 tests pass and the
game runs clean on the generated dots.

Added CREDITS.md, because Helton Yan's CC BY 4.0 makes attribution a licence
obligation rather than a courtesy. A file in the source tree does not discharge
it once the game ships -- an in-game credits screen is now a tracked todo, and
flagged as a licence requirement rather than polish.

NOT addressed here, and it needs a decision: these files remain in git history
at 9fa2e26. Removing them from the tip does not remove them from a clone. If
this repo is ever made public, history has to be rewritten (git filter-repo)
and force-pushed. Also, both bdragon packs are non-commercial in their free
tier, which conflicts with the stated Steam goal -- either contribute for the
commercial tier (still no redistribution) or replace with CC0 art, which would
solve both problems and let the assets back into the repo.

docs/ASSETS.md

@@ -18,32 +18,63 @@ place, [src/view/art.gd](../src/view/art.gd), and
 `tests/unit/test_art.gd` asserts every rect lands inside its texture — a wrong
 atlas coordinate does not error, it silently draws the wrong pixels.
 
-## Packs
+## Licence findings
 
-All four are the **free** versions. Source URLs are recorded because the packs
-themselves are gitignored, so their bundled licence files are not in the repo.
+Checked against each pack's itch.io page. **Two of the four forbid
+redistribution**, which is what publishing a repository containing them would
+be — so they are not in the repository.
 
-| Pack | Source | In use | Licence |
-| --- | --- | --- | --- |
-| 0x72 Dungeon Tileset II v1.7 | https://0x72.itch.io/dungeontileset-ii | Terrain, player, enemies, boss → `assets/sprites/dungeon_tileset.png` | Confirm at source. Widely distributed as CC0 by Robert Norenberg (0x72); the bundled README is technical, not legal. |
-| Fire Pixel Bullet 16x16 | https://bdragon1727.itch.io/fire-pixel-bullet-16x16 | Bullets → `assets/sprites/bullets.png` | Confirm at source (free version). |
-| 750+ Effect and FX Pixel All | https://bdragon1727.itch.io/750-effect-and-fx-pixel-all | Impact effect → `assets/sprites/impact.png` | Confirm at source (free version). |
-| Helton Yan — Pixel Combat | https://heltonyan.itch.io/pixelcombat | SFX → `assets/audio/sfx/*.wav` | Confirm at source (free version). |
+| Pack | Licence | Commercial | Credit | In this repo? |
+| --- | --- | --- | --- | --- |
+| [0x72 DungeonTileset II](https://0x72.itch.io/dungeontileset-ii) | **CC0 1.0** (public domain) | Yes | Not required | **Yes** — `assets/sprites/dungeon_tileset.png` |
+| [Helton Yan Pixel Combat](https://heltonyan.itch.io/pixelcombat) | **CC BY 4.0** | Yes | **Required** | **Yes** — `assets/audio/sfx/` |
+| [Fire Pixel Bullet 16x16](https://bdragon1727.itch.io/fire-pixel-bullet-16x16) | Custom | **Non-commercial only** unless you contribute | Encouraged | **No** — local only |
+| [750+ Effect and FX Pixel All](https://bdragon1727.itch.io/750-effect-and-fx-pixel-all) | Custom | **Non-commercial only** unless you contribute | Encouraged | **No** — local only |
+
+### The blocking clause
+
+Both bdragon1727 packs state, verbatim:
+
+> **You cannot do:** Resell / redistribute this asset.
+
+And the paid tier of the FX pack is no better for this purpose:
+
+> You can NOT re-distribute the file, no matter how much you modify it you can
+> use it but not share or re-sell it.
+
+Putting those files in a public repository distributes them to everyone who
+clones it, which is squarely what that forbids. Paying for the commercial tier
+does **not** unlock it — the restriction survives payment and survives
+modification.
+
+So they live in `assets/local/`, which is gitignored. `Art.bullets_texture()`
+and `Art.impact_texture()` load them at runtime if present and return null if
+not; the bullet renderer falls back to a generated dot. Verified both ways: with
+the files present the game uses them, and with them hidden the suite still
+passes 156/156 and the game runs.
+
+This is also why nothing there may be `preload()`ed — `preload` resolves at
+compile time and would fail the build on every machine that lacks the files.
+
+### Two obligations this creates
+
+1. **Helton Yan's CC BY 4.0 requires attribution**, and it is not satisfied by
+   a file in the source tree once the game ships. Players need to be able to
+   see it. [CREDITS.md](../CREDITS.md) records it for now; an in-game credits
+   screen is a todo.
+2. **Both bdragon packs are non-commercial in their free tier.** The stated
+   goal is a Steam release. Before that happens they need either a paid
+   contribution to bdragon1727 (which permits commercial use but still not
+   redistribution) or replacement with CC0 art. A CC0 replacement solves both
+   problems at once and lets the assets go back in the repo.
 
 ### Not in use
 
-`assetpacks/considering_dont_use_yet/` is the user's own "not chosen" marker and
-nothing there is referenced by the game. It contains RF Catacombs v1.0 (public
-domain per its bundled `public-license.txt` — free for personal or commercial
-use, credit appreciated, no reselling; artwork by Szadi art), plus Tiny RPG
-Character Pack 02 and neo_zero demos, whose terms are unrecorded.
-
-### Still to confirm
-
-Free itch.io packs vary: some are CC0, some require credit, some restrict
-commercial use, and "free version" often carries different terms from the paid
-one. Four rows above say *confirm at source* — do that before a public build,
-and if any require attribution, the credits screen does not exist yet.
+`assetpacks/considering_dont_use_yet/` is the "not chosen" marker and nothing
+there is referenced. It contains RF Catacombs v1.0 (public domain per its
+bundled `public-license.txt` — free for personal or commercial use, credit
+appreciated, no reselling; artwork by Szadi art), plus Tiny RPG Character Pack
+02 and neo_zero demos, whose terms are unrecorded.
 
 ## Converting audio before use
 

docs/ROADMAP.md

@@ -68,6 +68,8 @@ play off server events. Enough to prove the pipeline, not a finished look.
 | Impact/death VFX animation | todo | `Art.IMPACT` is loaded and validated but nothing plays it yet |
 | Directional sprites, hit flashes, screen shake | todo | |
 | Audio buses and a volume setting | todo | Everything plays on Master at hardcoded dB |
+| **In-game credits screen** | **todo** | Not cosmetic: the SFX are CC BY 4.0 and attribution is a licence *requirement*. [CREDITS.md](../CREDITS.md) is not reachable by a player. |
+| Replace the two non-redistributable packs | todo | Bullet and FX art is local-only and non-commercial. CC0 replacements would let them into the repo and unblock a commercial release. See [ASSETS.md](ASSETS.md). |
 
 ## Stage 2 — Characters, persistence, levels · *todo, next*