Hub character swapping, XP percentage, passive health regeneration

Character swapping is hub-only, and refused by the SERVER rather than merely
greyed out in the menu. Allowing it inside a dungeon would be an instant,
uninterruptible exit from danger -- strictly better than the one-second escape
channel, which would make that channel pointless. Creating a character in a
dungeon is refused for the same reason. Both are covered by diag_progression.

Health regenerates at 0.5% of MAXIMUM per second. A percentage rather than a
flat rate so it does not become irrelevant at level 15: a capped character
regains 1.2 hp/s against a level 1's 0.5, and both take about 200 seconds to
heal from nothing. No out-of-combat gate -- at this rate it cannot out-heal
anything actually shooting at you, and a trickle that never stops is easier to
reason about than a timer players have to learn. A fractional carry is needed
because a tick heals well under one hit point, so truncating each tick would
heal exactly nothing; there is a test for that specifically.

The XP bar now states the percentage and the level it leads to, since a bar
answers "how far" vaguely and a number answers it exactly.

Recorded the two Stage 3 answers: 4 inventory slots, and the boss's food item
is player-instanced now so the mechanism gets exercised rather than deferred.

Writing the swap guard's test caught my own mistake: the first version created
its spare character through the store, which has no opinion about where you
are, so it bypassed the guard it was meant to prove and left a stray character
behind that broke a later assertion.

200 tests. check.sh, test.sh, smoke.sh and both diagnostics pass.

src/net/protocol.gd

@@ -11,7 +11,8 @@ extends RefCounted
 ##    the wire value of every event after it -- a mismatched client would
 ##    mis-decode every hit and death, so the handshake has to reject it.
 ## 5: handshake carries an auth ticket instead of a bare name; added character
-##    list/select/create messages and per-player max health in the snapshot.
+##    list/select/create messages, per-player max health and colour in the
+##    snapshot.
 const VERSION := 5
 const DEFAULT_PORT := 27015
 const MAX_CLIENTS := 32
@@ -29,7 +30,17 @@ enum InstanceKind { LOBBY, DUNGEON }
 
 ## Why a character selection failed. Sent rather than a bare "no", so the UI can
 ## say something useful instead of appearing broken.
-enum SelectResult { OK, NO_SUCH_CHARACTER, CHARACTER_IS_DEAD, LIMIT_REACHED, NOT_AUTHENTICATED }
+enum SelectResult {
+	OK,
+	NO_SUCH_CHARACTER,
+	CHARACTER_IS_DEAD,
+	LIMIT_REACHED,
+	NOT_AUTHENTICATED,
+	## Swapping is hub-only. Allowing it inside a dungeon would be an instant,
+	## uninterruptible exit from danger -- strictly better than the one-second
+	## escape channel, and it would make that channel pointless.
+	NOT_IN_HUB,
+}
 
 ## Player flags packed into the snapshot's per-player byte.
 const F_ALIVE := 1

src/net/server_runtime.gd

@@ -233,6 +233,15 @@ func on_select_character(peer_id: int, character_id: String) -> void:
 		return
 	# Looked up against THIS account's characters, so a client cannot select
 	# somebody else's by guessing an id.
+	# Hub only. A player inside a dungeon who could swap character would have an
+	# instant escape from anything dangerous -- strictly better than the escape
+	# channel, and it would hollow out the whole reason that channel exists.
+	# Checked here rather than hidden in the UI, which a modified client ignores.
+	var here := instance_of(peer_id)
+	if here != null and here.kind != Protocol.InstanceKind.LOBBY:
+		Net.send_select_result(peer_id, Protocol.SelectResult.NOT_IN_HUB,
+			"you can only change character in the hub")
+		return
 	var c := store.get_character(account, character_id)
 	if c == null:
 		Net.send_select_result(peer_id, Protocol.SelectResult.NO_SUCH_CHARACTER, "no such character")
@@ -251,6 +260,11 @@ func on_create_character(peer_id: int, character_name: String) -> void:
 	if account == AuthProvider.NO_ACCOUNT:
 		Net.send_select_result(peer_id, Protocol.SelectResult.NOT_AUTHENTICATED, "not signed in")
 		return
+	var where := instance_of(peer_id)
+	if where != null and where.kind != Protocol.InstanceKind.LOBBY:
+		Net.send_select_result(peer_id, Protocol.SelectResult.NOT_IN_HUB,
+			"you can only change character in the hub")
+		return
 	var c := store.create_character(account, character_name)
 	if c == null:
 		Net.send_select_result(peer_id, Protocol.SelectResult.LIMIT_REACHED,