Fix permanent input-timing desync; no i-frames; UI respawn; guard dead joins

The real cause of the ship/bullet separation, which the previous commit only
half-addressed. The server dropped inputs past a lead of 12 while the client
only re-synced past 16, so a client whose lead drifted into 13-16 had every
input silently rejected while believing its timing was fine. The server coasted
on held_input and then stopped; the client kept predicting. The two separated
permanently and the reconciler fought it every snapshot -- "shoved around".
It needed two independent clocks to drift, hence "only after some time", and
nothing in the loop could notice, hence "then persists". The listen-server
diagnostic could never reproduce it: one process, one physics tick, lead
constant by construction.

Two defences: INPUT_MAX_LEAD (40) is now far wider than the client's correction
band (3..20), asserted by tests/unit/test_input_lead.gd so narrowing it fails a
test; and an ack-stall detector re-syncs when last_input_tick stops advancing,
which catches the whole class regardless of cause -- lead alone cannot, because
a wrong lead looks normal from the client. diag_prediction.gd now injects a +14
tick drift and exits non-zero unless the gap recovers.

Also:
- No invulnerability frames. Every bullet that touches a player lands; i-frames
  made dense patterns safer than sparse ones, which inverts the genre. Measured:
  a stationary player survives ~13.6s of the Warden's opening phase, ~17.5s
  drifting. spawn_grace remains the only invulnerable state.
- Death is exited with a HUD button, disabled for the first 3s. The lockout is
  enforced in SimWorld, not just by graying the button -- a client that ignores
  its own UI still waits. The interact key no longer respawns.
- Joining a server that is not there no longer drops the player into an empty
  lobby they cannot act in. Net.join() only creates an ENet object; the game
  scene now waits for the server to actually place us in an instance, with an
  8s timeout, and headless runs exit non-zero instead of idling.

Protocol 2 -> 3. 98 tests; check.sh, test.sh and smoke.sh all pass.

tests/integration/test_replica_parity.gd

@@ -81,7 +81,6 @@ func test_bullets_killed_by_a_hit_are_removed_from_the_replica() -> void:
 	server.add_player(1, "tester")
 	# Just below the boss, inside the ring pattern rather than at its centre.
 	server.players[1].pos = Vector2(0.0, 20.0)
-	server.players[1].iframes = 0
 	server.spawn_boss(Content.warden())
 	var hits := 0
 	for _i in 900:

tests/unit/test_emergency_escape.gd

@@ -9,7 +9,6 @@ const PEER := 3
 func before_each() -> void:
 	world = SimWorld.new(1)
 	world.add_player(PEER, "tester")
-	world.players[PEER].iframes = 0
 
 
 func _hold_escape(ticks: int) -> void:
@@ -65,7 +64,6 @@ func test_dying_ends_the_channel() -> void:
 	_hold_escape(20)
 	var p: SimPlayer = world.players[PEER]
 	p.hp = 1
-	p.iframes = 0
 	world.pool.spawn(p.pos, Vector2.ZERO, 6.0, 60, 999,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
 	world.step()
@@ -91,7 +89,6 @@ func test_a_linkdead_player_is_still_killable_while_channelling() -> void:
 	var p: SimPlayer = world.players[PEER]
 	p.linkdead = true
 	p.hp = 1
-	p.iframes = 0
 	world.step()
 	world.pool.spawn(p.pos, Vector2.ZERO, 6.0, 60, 999,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)

tests/unit/test_input_lead.gd

@@ -0,0 +1,70 @@
+extends GutTest
+## The client numbers its input frames a fixed "lead" ahead of the server's
+## tick, and the server accepts a window around its own tick. These two numbers
+## have to be chosen together.
+##
+## They were not, and the result was the worst kind of bug: the server silently
+## dropped every input from a client whose lead had drifted into the gap between
+## "server stops accepting" and "client notices", the client never corrected
+## because by its own reckoning nothing was wrong, and the server coasted on a
+## stale input forever. It needed two independent clocks to drift apart, so it
+## only appeared after a few minutes -- and then never went away.
+
+var world: SimWorld
+const PEER := 5
+
+
+func before_each() -> void:
+	world = SimWorld.new(1)
+	world.add_player(PEER, "tester")
+	world.tick = 1000
+
+
+func _queue_at_lead(lead: int) -> void:
+	var frames: Array[InputFrame] = [
+		InputFrame.make(world.tick + lead, Vector2.RIGHT, 0.0, 0)]
+	world.queue_input(PEER, frames)
+
+
+## The invariant that was violated. The client corrects itself at
+## INPUT_LEAD_MAX; the server must keep accepting well past that, or there is a
+## band where the server refuses input the client still thinks is fine.
+func test_the_server_accepts_every_lead_the_client_tolerates() -> void:
+	assert_gt(SimConfig.INPUT_MAX_LEAD, SimConfig.INPUT_LEAD_MAX,
+		"the server's acceptance window must be wider than the client's " +
+		"correction band, or drift lands in a silent dead zone")
+
+
+func test_inputs_across_the_whole_client_band_are_accepted() -> void:
+	for lead in range(SimConfig.INPUT_LEAD_MIN, SimConfig.INPUT_LEAD_MAX + 1):
+		world.players[PEER].input_queue.clear()
+		world.players[PEER].last_input_tick = 0
+		_queue_at_lead(lead)
+		assert_eq(world.players[PEER].input_queue.size(), 1,
+			"lead %d is inside the band the client will not correct, so the " % lead +
+			"server has to accept it")
+
+
+func test_absurd_lead_is_still_rejected() -> void:
+	_queue_at_lead(SimConfig.INPUT_MAX_LEAD + 1)
+	assert_eq(world.players[PEER].input_queue.size(), 0,
+		"the window is wider, not gone -- a client claiming a far-future tick " +
+		"still buys nothing")
+
+
+## What the drift actually looked like from the server's side: nothing arrives,
+## so it coasts on the last input it saw. That is correct behaviour for a brief
+## hiccup and catastrophic as a permanent state, which is why the client now
+## has a stall detector rather than relying on its lead estimate alone.
+func test_a_starved_server_coasts_then_stops() -> void:
+	var p: SimPlayer = world.players[PEER]
+	_queue_at_lead(SimConfig.INPUT_TARGET_LEAD)
+	world.step()
+	var moved_once: Vector2 = p.pos
+	assert_ne(moved_once, Vector2.ZERO, "setup: the input should have moved us")
+	for _i in SimConfig.INPUT_MAX_AGE + 5:
+		world.step()
+	var coasted: Vector2 = p.pos
+	for _i in 60:
+		world.step()
+	assert_eq(p.pos, coasted, "coasting has to end, or a silent client drifts forever")

tests/unit/test_input_lead.gd.uid

@@ -0,0 +1 @@
+uid://xemxybh1gvvo

tests/unit/test_server_authority.gd

@@ -91,7 +91,6 @@ func test_a_starved_player_eventually_stops_moving() -> void:
 func test_enemy_bullets_damage_the_player_and_are_consumed() -> void:
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
-	p.iframes = 0
 	world.pool.spawn(Vector2(-1.0, 0.0), Vector2.ZERO, 6.0, 60, 25,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
 	world.step()
@@ -99,22 +98,37 @@ func test_enemy_bullets_damage_the_player_and_are_consumed() -> void:
 	assert_eq(world.pool.live_count, 0, "a bullet that hits must be consumed")
 
 
-func test_invulnerability_frames_stop_a_second_hit() -> void:
+## The inverse of what this asserted before. There are no i-frames: in a bullet
+## hell the wall is the threat, and letting one hit grant immunity to the rest
+## of the wall inverts the whole risk model.
+func test_every_bullet_in_a_wall_lands() -> void:
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
-	p.iframes = 0
-	for _i in 2:
+	for _i in 3:
 		world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 25,
 			SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
 	world.step()
-	assert_eq(p.hp, SimConfig.PLAYER_MAX_HP - 25, "two bullets in one tick is still one hit")
+	assert_eq(p.hp, SimConfig.PLAYER_MAX_HP - 75,
+		"three bullets is three hits, not one")
+
+
+func test_consecutive_ticks_both_deal_damage() -> void:
+	var p: SimPlayer = world.players[PEER]
+	p.pos = Vector2.ZERO
+	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 10,
+		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
+	world.step()
+	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 10,
+		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
+	world.step()
+	assert_eq(p.hp, SimConfig.PLAYER_MAX_HP - 20,
+		"there is no window of immunity after a hit")
 
 
 func test_a_replica_world_never_resolves_a_hit() -> void:
 	world.authoritative = false
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
-	p.iframes = 0
 	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 25,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
 	world.step()
@@ -126,7 +140,6 @@ func _kill_player() -> SimPlayer:
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
 	p.hp = 5
-	p.iframes = 0
 	p.spawn_grace = 0
 	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 25,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)
@@ -150,6 +163,7 @@ func test_a_downed_player_stays_down_without_input() -> void:
 
 func test_a_downed_player_asking_to_respawn_is_reported_once_per_tick() -> void:
 	_kill_player()
+	_drive(SimConfig.RESPAWN_LOCKOUT_TICKS)
 	world.drain_events()
 	_drive(1, Vector2.ZERO, InputFrame.BTN_INTERACT)
 	assert_eq(_events_of(SimEvent.Type.RESPAWN_REQUESTED).size(), 1,
@@ -159,6 +173,28 @@ func test_a_downed_player_asking_to_respawn_is_reported_once_per_tick() -> void:
 	assert_false(world.players[PEER].alive)
 
 
+## The HUD disables its button for the same duration, but that is presentation.
+## A client that ignores its own UI and spams the bit still has to wait.
+func test_the_respawn_lockout_is_enforced_by_the_server() -> void:
+	_kill_player()
+	world.drain_events()
+	_drive(SimConfig.RESPAWN_LOCKOUT_TICKS - 2, Vector2.ZERO, InputFrame.BTN_INTERACT)
+	assert_eq(_events_of(SimEvent.Type.RESPAWN_REQUESTED).size(), 0,
+		"holding the request down must not shorten the lockout")
+	_drive(4, Vector2.ZERO, InputFrame.BTN_INTERACT)
+	assert_gt(_events_of(SimEvent.Type.RESPAWN_REQUESTED).size(), 0,
+		"and it must actually open once the lockout expires")
+
+
+func test_the_lockout_is_reported_to_the_client() -> void:
+	_kill_player()
+	var snap := NetCodec.decode_snapshot(NetCodec.encode_snapshot(world))
+	var wait: float = snap["players"][0]["respawn_wait"]
+	assert_almost_eq(wait,
+		float(SimConfig.RESPAWN_LOCKOUT_TICKS) / float(SimConfig.TICK_RATE), 0.3,
+		"the HUD needs the countdown to render its disabled button")
+
+
 func test_respawn_request_never_reaches_the_client() -> void:
 	_kill_player()
 	_drive(1, Vector2.ZERO, InputFrame.BTN_INTERACT)
@@ -171,7 +207,6 @@ func test_respawn_request_never_reaches_the_client() -> void:
 func test_spawn_grace_blocks_damage_and_firing() -> void:
 	var p: SimPlayer = world.players[PEER]
 	p.pos = Vector2.ZERO
-	p.iframes = 0
 	p.spawn_grace = 60
 	world.pool.spawn(Vector2.ZERO, Vector2.ZERO, 6.0, 60, 25,
 		SimConfig.TEAM_ENEMY, SimConfig.KIND_ORB)