Pin the public map, fit the site to a phone, and stop refetching heads (#137)

[CaYatur]

Pin the public map, fit the site to a phone, and stop refetching heads (#137)

A world can be pinned. The public map followed whichever dimension people
were standing in and showed nothing when nobody was — so on a quiet server there
was nothing to open. An operator can now choose one world, picked from those
that exist on disk rather than typed from memory, and the site always shows it:
with nobody online, and whatever the query string says. The visitor gets no
dimension switcher with it, because a control that cannot change the answer is
not a control. Following the players stays the default.

The chosen name becomes a path segment when the tiles are read, so it is
restricted where it is stored rather than trusted where it is used.

The header lines up, and the page fits a phone. The right-hand controls —
language and the account chip — were loose children of the nav row, so a narrow
window dealt them out among the links. They are one group now, the brand
shrinks instead of shoving everything out of the row, and the links get their
own full-width scrollable strip below. A second breakpoint at phone width drops
the brand name (the logo still says which server this is), tightens the
buttons, and stacks the profile: smaller head, wrapping stat and coordinate
chips, a denser inventory grid, and a map toolbar that fits.

Player heads stop reloading. Three things were causing it: the requested
size was baked into the URL, so the 46px list avatar and the 72px detail avatar
were two separate images of the same player; the uuid was preferred over the
name, and on an offline-mode server that uuid is the derived one no skin service
has ever seen — the same trap as the map heads in #116; and a failure lived only
in component state, so every remount asked again and showed a gap while it
failed. One size is fetched and CSS scales it, the name decides, and the outcome
is remembered for the session. A head that is missing or still coming is a drawn
placeholder rather than a hole.

Asserted: the pin survives the config, overrides the query, reports itself and
offers exactly one dimension; an unpinned map still follows the query; and every
shape of bad world name — traversal, a slash, a dot, a space, an over-long one —
is refused at the boundary.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[CaYatur]

Self-review: a pinned custom world would not have been found on Linux

normalizeDimension lower-cases everything, and for a custom world that string
becomes a folder name — so a world called MyWorld was looked up as
myworld/region. That happens to work on Windows and does not on Linux, where
a Minecraft server is at least as likely to run, and the failure would have been
"pinning my world shows nothing" with no way to see why. The three real
dimensions still canonicalise; anything else keeps the case it was given.

Also dropped mapPinned from the public payload. I added it and then never read
it — the feed's own pinned flag already tells the page what it needs, and an
unread field is the pattern I hit in #107.