Fix permanent input-timing desync; no i-frames; UI respawn; guard dead joins

The real cause of the ship/bullet separation, which the previous commit only
half-addressed. The server dropped inputs past a lead of 12 while the client
only re-synced past 16, so a client whose lead drifted into 13-16 had every
input silently rejected while believing its timing was fine. The server coasted
on held_input and then stopped; the client kept predicting. The two separated
permanently and the reconciler fought it every snapshot -- "shoved around".
It needed two independent clocks to drift, hence "only after some time", and
nothing in the loop could notice, hence "then persists". The listen-server
diagnostic could never reproduce it: one process, one physics tick, lead
constant by construction.

Two defences: INPUT_MAX_LEAD (40) is now far wider than the client's correction
band (3..20), asserted by tests/unit/test_input_lead.gd so narrowing it fails a
test; and an ack-stall detector re-syncs when last_input_tick stops advancing,
which catches the whole class regardless of cause -- lead alone cannot, because
a wrong lead looks normal from the client. diag_prediction.gd now injects a +14
tick drift and exits non-zero unless the gap recovers.

Also:
- No invulnerability frames. Every bullet that touches a player lands; i-frames
  made dense patterns safer than sparse ones, which inverts the genre. Measured:
  a stationary player survives ~13.6s of the Warden's opening phase, ~17.5s
  drifting. spawn_grace remains the only invulnerable state.
- Death is exited with a HUD button, disabled for the first 3s. The lockout is
  enforced in SimWorld, not just by graying the button -- a client that ignores
  its own UI still waits. The interact key no longer respawns.
- Joining a server that is not there no longer drops the player into an empty
  lobby they cannot act in. Net.join() only creates an ENet object; the game
  scene now waits for the server to actually place us in an instance, with an
  8s timeout, and headless runs exit non-zero instead of idling.

Protocol 2 -> 3. 98 tests; check.sh, test.sh and smoke.sh all pass.

tests/unit/test_server_authority.gd

@@ -91,7 +91,6 @@ func test_a_starved_player_eventually_stops_moving() -> void:
 func test_enemy_bullets_damage_the_player_and_are_consumed() -> void:
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
-	p.iframes = 0
 	world.pool.spawn(Vector2(-1.0, 0.0), Vector2.ZERO, 6.0, 60, 25,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
 	world.step()
@@ -99,22 +98,37 @@ func test_enemy_bullets_damage_the_player_and_are_consumed() -> void:
 	assert_eq(world.pool.live_count, 0, "a bullet that hits must be consumed")
 
 
-func test_invulnerability_frames_stop_a_second_hit() -> void:
+## The inverse of what this asserted before. There are no i-frames: in a bullet
+## hell the wall is the threat, and letting one hit grant immunity to the rest
+## of the wall inverts the whole risk model.
+func test_every_bullet_in_a_wall_lands() -> void:
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
-	p.iframes = 0
-	for _i in 2:
+	for _i in 3:
 		world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 25,
 			SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
 	world.step()
-	assert_eq(p.hp, SimConfig.PLAYER_MAX_HP - 25, "two bullets in one tick is still one hit")
+	assert_eq(p.hp, SimConfig.PLAYER_MAX_HP - 75,
+		"three bullets is three hits, not one")
+
+
+func test_consecutive_ticks_both_deal_damage() -> void:
+	var p: SimPlayer = world.players[PEER]
+	p.pos = Vector2.ZERO
+	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 10,
+		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
+	world.step()
+	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 10,
+		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
+	world.step()
+	assert_eq(p.hp, SimConfig.PLAYER_MAX_HP - 20,
+		"there is no window of immunity after a hit")
 
 
 func test_a_replica_world_never_resolves_a_hit() -> void:
 	world.authoritative = false
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
-	p.iframes = 0
 	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 25,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
 	world.step()
@@ -126,7 +140,6 @@ func _kill_player() -> SimPlayer:
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
 	p.hp = 5
-	p.iframes = 0
 	p.spawn_grace = 0
 	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 25,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
@@ -150,6 +163,7 @@ func test_a_downed_player_stays_down_without_input() -> void:
 
 func test_a_downed_player_asking_to_respawn_is_reported_once_per_tick() -> void:
 	_kill_player()
+	_drive(SimConfig.RESPAWN_LOCKOUT_TICKS)
 	world.drain_events()
 	_drive(1, Vector2.ZERO, InputFrame.BTN_INTERACT)
 	assert_eq(_events_of(SimEvent.Type.RESPAWN_REQUESTED).size(), 1,
@@ -159,6 +173,28 @@ func test_a_downed_player_asking_to_respawn_is_reported_once_per_tick() -> void:
 	assert_false(world.players[PEER].alive)
 
 
+## The HUD disables its button for the same duration, but that is presentation.
+## A client that ignores its own UI and spams the bit still has to wait.
+func test_the_respawn_lockout_is_enforced_by_the_server() -> void:
+	_kill_player()
+	world.drain_events()
+	_drive(SimConfig.RESPAWN_LOCKOUT_TICKS - 2, Vector2.ZERO, InputFrame.BTN_INTERACT)
+	assert_eq(_events_of(SimEvent.Type.RESPAWN_REQUESTED).size(), 0,
+		"holding the request down must not shorten the lockout")
+	_drive(4, Vector2.ZERO, InputFrame.BTN_INTERACT)
+	assert_gt(_events_of(SimEvent.Type.RESPAWN_REQUESTED).size(), 0,
+		"and it must actually open once the lockout expires")
+
+
+func test_the_lockout_is_reported_to_the_client() -> void:
+	_kill_player()
+	var snap := NetCodec.decode_snapshot(NetCodec.encode_snapshot(world))
+	var wait: float = snap["players"][0]["respawn_wait"]
+	assert_almost_eq(wait,
+		float(SimConfig.RESPAWN_LOCKOUT_TICKS) / float(SimConfig.TICK_RATE), 0.3,
+		"the HUD needs the countdown to render its disabled button")
+
+
 func test_respawn_request_never_reaches_the_client() -> void:
 	_kill_player()
 	_drive(1, Vector2.ZERO, InputFrame.BTN_INTERACT)
@@ -171,7 +207,6 @@ func test_respawn_request_never_reaches_the_client() -> void:
 func test_spawn_grace_blocks_damage_and_firing() -> void:
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
-	p.iframes = 0
 	p.spawn_grace = 60
 	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 25,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)