Stage 2: accounts, characters, permadeath, levels and experience

Identity is shaped like Steamworks so swapping to it is one subclass and no
schema change: the client presents an opaque ticket, the server validates it
into a stable 64-bit account id, and nothing downstream sees anything else.
LocalAuthProvider takes any ticket at face value -- insecure on purpose, and
labelled as such everywhere, because the point is the shape rather than the
security. Do not ship it.

Characters persist as JSON keyed by account. Account ids are written as decimal
strings because they are 64-bit and JSON numbers are doubles, which would
silently round them. A corrupt store aborts the server rather than starting
empty: starting empty looks like it worked and then saves over every character
on the first level-up.

Levels 1-15, +10 max health each, level DERIVED from lifetime experience rather
than stored beside it, so a hand-edited save cannot produce a level 12 character
with a level 3's experience. Experience is shared undivided across everyone
alive in the instance -- splitting it would make bringing a friend cost you
progress. A level-up heals by what it added, so gaining one mid-fight is relief
rather than a bar that moved further from full.

Death is permanent and unbinds the character entirely: no "return to the hub as
the character who just died", because the run is over. The record is retired,
never deleted. The five-character cap counts LIVING characters only -- counting
the dead would lock a player out of their own account after five deaths.

Verified by tools/diag_progression.tscn, which drives the real server through
kill -> xp -> level -> health and death -> retire -> roster. The bot smoke test
cannot cover that: bots are poor shots and rarely kill anything. Writing it
caught two real ordering bugs -- the death event was dispatched before the
payload that tells the player they died, and the dead character stayed bound to
the peer.

Also added --account and --store so several clients and test runs can coexist
on one machine. The smoke test now uses a scratch store; without it a rerun
resumed the previous run's characters and "a character was created" quietly
stopped being true.

193 tests. check.sh, test.sh, smoke.sh, diag_progression and diag_prediction
all pass.

src/meta/character.gd

@@ -0,0 +1,104 @@
+class_name Character
+extends RefCounted
+## One playable character belonging to an account.
+##
+## Characters outlive a session and a server restart, so this is a persistence
+## record first and a gameplay object second: everything here has to survive a
+## round trip through JSON without losing meaning.
+##
+## Death does not delete a character. It clears [member active], which retires
+## it from the roster while keeping the record for archival and for working out
+## what happened after the fact.
+
+const MAX_NAME := 20
+
+var id: String = ""
+var display_name: String = "adventurer"
+## Placeholder identity until there is a cosmetic system. Random per character
+## so party members are told apart at a glance.
+var colour := Color.WHITE
+var level: int = Progression.START_LEVEL
+var total_xp: int = 0
+## False once the character has died. Never deleted -- see the class note.
+var active: bool = true
+var created_unix: int = 0
+var died_unix: int = 0
+
+
+static func create(character_name: String, rng: RandomNumberGenerator) -> Character:
+	var c := Character.new()
+	# Random-but-readable: full saturation and high value, so two characters are
+	# never both muddy browns, and none of them vanish against the floor.
+	c.colour = Color.from_hsv(rng.randf(), 0.55, 1.0)
+	c.id = "%d-%d" % [Time.get_unix_time_from_system(), rng.randi() & 0xFFFFFF]
+	c.display_name = sanitize_name(character_name)
+	c.created_unix = int(Time.get_unix_time_from_system())
+	return c
+
+
+## Names come from clients and are shown to other players, so they are clamped
+## here rather than trusted anywhere downstream.
+static func sanitize_name(raw: String) -> String:
+	var clean := raw.strip_edges().substr(0, MAX_NAME)
+	# Control characters would let a name break the HUD's layout.
+	var out := ""
+	for ch in clean:
+		if ch.unicode_at(0) >= 32:
+			out += ch
+	out = out.strip_edges()
+	return out if not out.is_empty() else "adventurer"
+
+
+func max_hp() -> int:
+	return Progression.max_hp_for_level(level)
+
+
+func xp_progress() -> float:
+	return Progression.level_progress(total_xp)
+
+
+## Award experience and return how many levels it produced, so the caller can
+## announce them. Level is derived from lifetime xp rather than tracked
+## separately: one source of truth means a level can never disagree with the
+## experience that earned it.
+func grant_xp(amount: int) -> int:
+	if amount <= 0 or not active:
+		return 0
+	var before := level
+	total_xp += amount
+	level = Progression.level_for_xp(total_xp)
+	return level - before
+
+
+func retire(when_unix: int = 0) -> void:
+	active = false
+	died_unix = when_unix if when_unix > 0 else int(Time.get_unix_time_from_system())
+
+
+func to_dict() -> Dictionary:
+	return {
+		"id": id,
+		"name": display_name,
+		"colour": colour.to_html(false),
+		"level": level,
+		"xp": total_xp,
+		"active": active,
+		"created": created_unix,
+		"died": died_unix,
+	}
+
+
+## Tolerant of missing keys so an older save file still loads: a character that
+## has lost a field is far better than an account that will not open.
+static func from_dict(d: Dictionary) -> Character:
+	var c := Character.new()
+	c.id = String(d.get("id", ""))
+	c.display_name = sanitize_name(String(d.get("name", "")))
+	c.colour = Color.from_string(String(d.get("colour", "ffffff")), Color.WHITE)
+	c.total_xp = maxi(int(d.get("xp", 0)), 0)
+	# Derived, not read: a hand-edited or corrupted level cannot desync from xp.
+	c.level = Progression.level_for_xp(c.total_xp)
+	c.active = bool(d.get("active", true))
+	c.created_unix = int(d.get("created", 0))
+	c.died_unix = int(d.get("died", 0))
+	return c