Stage 2: accounts, characters, permadeath, levels and experience

Identity is shaped like Steamworks so swapping to it is one subclass and no
schema change: the client presents an opaque ticket, the server validates it
into a stable 64-bit account id, and nothing downstream sees anything else.
LocalAuthProvider takes any ticket at face value -- insecure on purpose, and
labelled as such everywhere, because the point is the shape rather than the
security. Do not ship it.

Characters persist as JSON keyed by account. Account ids are written as decimal
strings because they are 64-bit and JSON numbers are doubles, which would
silently round them. A corrupt store aborts the server rather than starting
empty: starting empty looks like it worked and then saves over every character
on the first level-up.

Levels 1-15, +10 max health each, level DERIVED from lifetime experience rather
than stored beside it, so a hand-edited save cannot produce a level 12 character
with a level 3's experience. Experience is shared undivided across everyone
alive in the instance -- splitting it would make bringing a friend cost you
progress. A level-up heals by what it added, so gaining one mid-fight is relief
rather than a bar that moved further from full.

Death is permanent and unbinds the character entirely: no "return to the hub as
the character who just died", because the run is over. The record is retired,
never deleted. The five-character cap counts LIVING characters only -- counting
the dead would lock a player out of their own account after five deaths.

Verified by tools/diag_progression.tscn, which drives the real server through
kill -> xp -> level -> health and death -> retire -> roster. The bot smoke test
cannot cover that: bots are poor shots and rarely kill anything. Writing it
caught two real ordering bugs -- the death event was dispatched before the
payload that tells the player they died, and the dead character stayed bound to
the peer.

Also added --account and --store so several clients and test runs can coexist
on one machine. The smoke test now uses a scratch store; without it a rerun
resumed the previous run's characters and "a character was created" quietly
stopped being true.

193 tests. check.sh, test.sh, smoke.sh, diag_progression and diag_prediction
all pass.

src/net/client_runtime.gd

@@ -15,6 +15,9 @@ signal local_hit(damage: int)
 signal shot_fired
 signal enemy_died
 signal boss_died
+## The account's character roster changed: created, selected, levelled or died.
+signal characters_changed
+signal select_failed(reason: String)
 
 var my_peer: int = 0
 var instance_id: int = 0
@@ -38,6 +41,9 @@ var _last_move := Vector2.ZERO
 
 # Authoritative mirror of the local player.
 var my_hp: int = SimConfig.PLAYER_MAX_HP
+## Follows the character's level, so the HUD bar cannot be computed from a
+## constant.
+var my_max_hp: int = SimConfig.PLAYER_MAX_HP
 var my_alive: bool = true
 var my_escape: float = 0.0
 var my_escaping: bool = false
@@ -59,6 +65,14 @@ var request_escape: bool = false
 ## Who is online and where, for the hub's player list. Server-pushed.
 var roster: Array[Dictionary] = []
 
+## This account's characters, and which one is being played. Server-pushed;
+## the client never invents an entry.
+var characters: Array[Dictionary] = []
+var selected_character: String = ""
+## True once the server has told us the roster, so the UI can tell "no
+## characters yet" from "not asked yet".
+var characters_known: bool = false
+
 ## Whole seconds until a cleared dungeon returns the party, or
 ## Protocol.COUNTDOWN_NONE outside that state.
 var cleared_countdown: int = Protocol.COUNTDOWN_NONE
@@ -227,6 +241,49 @@ func on_map_chunks(from_instance: int, data: PackedByteArray) -> void:
 	NetCodec.decode_map_chunks_into(world.map, data)
 
 
+func on_characters(data: PackedByteArray) -> void:
+	var decoded := NetCodec.decode_characters(data)
+	characters = decoded["characters"]
+	selected_character = String(decoded["selected"])
+	characters_known = true
+	characters_changed.emit()
+	hud_dirty.emit()
+	_bot_pick_character()
+
+
+## A bot has no roster screen to click, so it makes the choice the screen would
+## offer: resume a living character, or create one. Without this the smoke test
+## would authenticate and then stand at a menu forever.
+func _bot_pick_character() -> void:
+	if not GameOpts.bot_client or not selected_character.is_empty():
+		return
+	for c in characters:
+		if c["active"]:
+			Net.select_character(String(c["id"]))
+			return
+	Net.create_character(GameOpts.player_name)
+
+
+func on_select_result(result: int, reason: String) -> void:
+	if result != Protocol.SelectResult.OK:
+		GameLog.warn("client", "character selection refused: %s" % reason)
+		select_failed.emit(reason)
+
+
+## The character currently being played, or an empty dictionary while none is.
+func current_character() -> Dictionary:
+	for c in characters:
+		if String(c["id"]) == selected_character:
+			return c
+	return {}
+
+
+## True when the player has no character in the world and must pick one -- at
+## first login, or after their last one died.
+func needs_character() -> bool:
+	return characters_known and selected_character.is_empty()
+
+
 func on_roster(data: PackedByteArray) -> void:
 	roster = NetCodec.decode_roster(data)
 	hud_dirty.emit()
@@ -301,6 +358,7 @@ func on_snapshot(data: PackedByteArray) -> void:
 ## land where the client should actually be right now.
 func _reconcile(rec: Dictionary) -> void:
 	my_hp = int(rec["hp"])
+	my_max_hp = int(rec["max_hp"])
 	my_alive = (int(rec["flags"]) & Protocol.F_ALIVE) != 0
 	my_escaping = (int(rec["flags"]) & Protocol.F_ESCAPING) != 0
 	my_spawn_grace = (int(rec["flags"]) & Protocol.F_SPAWN_GRACE) != 0