Stage 2: accounts, characters, permadeath, levels and experience

Identity is shaped like Steamworks so swapping to it is one subclass and no
schema change: the client presents an opaque ticket, the server validates it
into a stable 64-bit account id, and nothing downstream sees anything else.
LocalAuthProvider takes any ticket at face value -- insecure on purpose, and
labelled as such everywhere, because the point is the shape rather than the
security. Do not ship it.

Characters persist as JSON keyed by account. Account ids are written as decimal
strings because they are 64-bit and JSON numbers are doubles, which would
silently round them. A corrupt store aborts the server rather than starting
empty: starting empty looks like it worked and then saves over every character
on the first level-up.

Levels 1-15, +10 max health each, level DERIVED from lifetime experience rather
than stored beside it, so a hand-edited save cannot produce a level 12 character
with a level 3's experience. Experience is shared undivided across everyone
alive in the instance -- splitting it would make bringing a friend cost you
progress. A level-up heals by what it added, so gaining one mid-fight is relief
rather than a bar that moved further from full.

Death is permanent and unbinds the character entirely: no "return to the hub as
the character who just died", because the run is over. The record is retired,
never deleted. The five-character cap counts LIVING characters only -- counting
the dead would lock a player out of their own account after five deaths.

Verified by tools/diag_progression.tscn, which drives the real server through
kill -> xp -> level -> health and death -> retire -> roster. The bot smoke test
cannot cover that: bots are poor shots and rarely kill anything. Writing it
caught two real ordering bugs -- the death event was dispatched before the
payload that tells the player they died, and the dead character stayed bound to
the peer.

Also added --account and --store so several clients and test runs can coexist
on one machine. The smoke test now uses a scratch store; without it a rerun
resumed the previous run's characters and "a character was created" quietly
stopped being true.

193 tests. check.sh, test.sh, smoke.sh, diag_progression and diag_prediction
all pass.

src/view/game_scene.gd

@@ -7,8 +7,12 @@ extends Node2D
 @onready var hud: CanvasLayer = $HUD
 @onready var menu: CanvasLayer = $GameMenu
 @onready var sfx: Node = $Sfx
+@onready var characters: CanvasLayer = $CharacterSelect
 
 var _bound: ClientRuntime = null
+## Opened deliberately from the menu, as opposed to forced open by having no
+## character to play.
+var _roster_open: bool = false
 
 
 func _ready() -> void:
@@ -17,6 +21,8 @@ func _ready() -> void:
 	menu.return_to_hub_requested.connect(_on_return_to_hub)
 	menu.disconnect_requested.connect(_on_disconnect)
 	hud.respawn_pressed.connect(_on_respawn_pressed)
+	characters.select_requested.connect(func(id: String) -> void: Net.select_character(id))
+	characters.create_requested.connect(func(n: String) -> void: Net.create_character(n))
 
 
 var _screen_centre := Vector2.ZERO
@@ -48,6 +54,13 @@ func _process(_delta: float) -> void:
 			_bound.shot_fired.connect(func() -> void: sfx.play(Art.SFX_SHOOT, -14.0))
 			_bound.enemy_died.connect(func() -> void: sfx.play(Art.SFX_ENEMY_DEATH, -8.0))
 			_bound.boss_died.connect(func() -> void: sfx.play(Art.SFX_BOSS_DEATH, -2.0))
+			_bound.characters_changed.connect(_refresh_characters)
+			_bound.select_failed.connect(func(why: String) -> void: characters.set_status(why))
+			_refresh_characters()
+	# The roster screen is shown exactly when there is nothing to play: first
+	# login, or after the last living character died.
+	if _bound != null:
+		characters.visible = _bound.needs_character() or _roster_open
 	_follow_camera()
 	menu.set_in_dungeon(_bound != null
 		and _bound.instance_kind == Protocol.InstanceKind.DUNGEON)
@@ -66,6 +79,11 @@ func _on_disconnect() -> void:
 
 
 ## Sets the intent bit; the server decides whether the lockout has expired.
+func _refresh_characters() -> void:
+	if _bound != null:
+		characters.refresh(_bound.characters, _bound.selected_character)
+
+
 func _on_respawn_pressed() -> void:
 	if _bound != null:
 		_bound.request_respawn = true

src/view/world_view.gd

@@ -197,8 +197,10 @@ func _draw_boss() -> void:
 func _draw_remote_player(p: Dictionary) -> void:
 	var flags := int(p["flags"])
 	var alive := (flags & Protocol.F_ALIVE) != 0
-	var col := COL_REMOTE if alive else COL_DEAD
-	_draw_ship(p["pos"], p["aim"], col, alive)
+	# Each character's own colour, which is the only thing telling party
+	# members apart until there is a cosmetic system.
+	var col: Color = p["colour"] if alive else COL_DEAD
+	_draw_ship(p["pos"], p["aim"], col, alive, false, Art.PLAYER_ANCHOR)
 	if (flags & Protocol.F_SPAWN_GRACE) != 0:
 		_draw_grace_ring(p["pos"])
 	if (flags & Protocol.F_ESCAPING) != 0:
@@ -209,7 +211,9 @@ func _draw_local_player() -> void:
 	if not client.my_alive:
 		_draw_ship(client.predicted_pos, client.aim, COL_DEAD, false)
 		return
-	_draw_ship(client.predicted_pos, client.aim, COL_LOCAL, true, client.is_moving())
+	var mine := client.current_character()
+	var my_colour: Color = mine["colour"] if not mine.is_empty() else COL_LOCAL
+	_draw_ship(client.predicted_pos, client.aim, my_colour, true, client.is_moving())
 	if client.my_spawn_grace:
 		_draw_grace_ring(client.predicted_pos)
 	if client.my_escaping:
@@ -228,12 +232,16 @@ func _draw_grace_ring(pos: Vector2) -> void:
 ## is deliberately larger than PLAYER_RADIUS, the hitbox used for hits. A bullet
 ## can visibly clip the sprite without landing, which reads as more forgiving of
 ## latency than the reverse. See sim_config.gd.
-func _draw_ship(pos: Vector2, aim: float, col: Color, alive: bool, moving: bool = false) -> void:
+func _draw_ship(pos: Vector2, aim: float, col: Color, alive: bool,
+		moving: bool = false, _unused: Vector2 = Vector2.ZERO) -> void:
 	var strip := Art.PLAYER_RUN if moving else Art.PLAYER_IDLE
 	var src := Art.frame(strip, Art.anim_frame(_anim_time, 0))
 	# Faces the way you aim, which is the whole point of a twin-stick.
 	var flip := absf(wrapf(aim, -PI, PI)) > PI * 0.5
-	_draw_sprite(Art.TILESET, src, pos, col if not alive else Color.WHITE, flip,
+	# Tinted rather than replaced: modulate keeps the sprite's shading, so a
+	# character reads as coloured armour rather than a flat silhouette.
+	var tint := col if alive else COL_DEAD
+	_draw_sprite(Art.TILESET, src, pos, tint.lerp(Color.WHITE, 0.35), flip,
 		Art.PLAYER_ANCHOR)
 	if alive:
 		var dir := Vector2.RIGHT.rotated(aim)