Hub character swapping, XP percentage, passive health regeneration

Character swapping is hub-only, and refused by the SERVER rather than merely
greyed out in the menu. Allowing it inside a dungeon would be an instant,
uninterruptible exit from danger -- strictly better than the one-second escape
channel, which would make that channel pointless. Creating a character in a
dungeon is refused for the same reason. Both are covered by diag_progression.

Health regenerates at 0.5% of MAXIMUM per second. A percentage rather than a
flat rate so it does not become irrelevant at level 15: a capped character
regains 1.2 hp/s against a level 1's 0.5, and both take about 200 seconds to
heal from nothing. No out-of-combat gate -- at this rate it cannot out-heal
anything actually shooting at you, and a trickle that never stops is easier to
reason about than a timer players have to learn. A fractional carry is needed
because a tick heals well under one hit point, so truncating each tick would
heal exactly nothing; there is a test for that specifically.

The XP bar now states the percentage and the level it leads to, since a bar
answers "how far" vaguely and a number answers it exactly.

Recorded the two Stage 3 answers: 4 inventory slots, and the boss's food item
is player-instanced now so the mechanism gets exercised rather than deferred.

Writing the swap guard's test caught my own mistake: the first version created
its spare character through the store, which has no opinion about where you
are, so it bypassed the guard it was meant to prove and left a stray character
behind that broke a later assertion.

200 tests. check.sh, test.sh, smoke.sh and both diagnostics pass.

tools/diag_progression.gd

@@ -97,6 +97,21 @@ func _physics_process(_delta: float) -> void:
 		_check(p.max_hp == Progression.max_hp_for_level(c.level),
 			"and matches the curve exactly")
 
+	elif _step == 70:
+		# Swapping inside a dungeon would be an instant, uninterruptible exit
+		# from danger. The server must refuse it whatever the UI allows.
+		var before: String = _srv.peer_characters.get(Net.LOCAL_PEER, "")
+		_srv.on_select_character(Net.LOCAL_PEER, before)
+		_check(_srv.peer_characters.get(Net.LOCAL_PEER, "") == before,
+			"a character swap inside a dungeon is refused")
+		# Through the server's entry point, not the store's -- the store has no
+		# opinion about where you are, and calling it directly would bypass the
+		# guard this is checking (and leave a stray character behind).
+		var before_count := _srv.store.characters_for(_account).size()
+		_srv.on_create_character(Net.LOCAL_PEER, "spare")
+		_check(_srv.store.characters_for(_account).size() == before_count,
+			"creating a character inside a dungeon is refused too")
+
 	elif _step == 90:
 		# Stop behaving like a bot before the kill. A bot auto-creates a
 		# replacement the instant it sees an empty roster -- correct in play,