Alpha 0.3.7: add Genesis resources and compact Realm chrome

[ael-dev3]

Summary

• append private Food, Wood, Stone, and Gold authority per founded castle while keeping Marks separate and all starting balances at zero
• settle terrain yield in exact ten-minute server-time quanta through caller-bound no-input APIs
• replace the player HUD and bottom rail with one PFP-only launcher, a transparent authoritative five-resource rail, and a compact portrait menu
• present selected castles with transparent overhanging record art while preserving independently scoped observer presentation
• add exact bigint decoding, stale-session protection, immutable resource icons, generated bindings, guarded legacy-founder backfill, counts-only v4 inspection, additive migration proof, and responsive browser contracts

Safety boundary

This is an undeployed draft candidate. No production SpacetimeDB publication, founder backfill, Pages deployment, tag, release, secret rotation, or production data mutation ran. Those actions remain separately owner-approval-gated.

One bounded read-only pre-deploy check confirmed the canonical frontend and redirects, then stopped at the expected undeployed candidate bridge-CORS gate. It changed no production state.

PR #40 is not replayed or integrated here. It was already merged into v0.3.5 and is ancestral to the current v0.3.6 base.

Local evidence

• root: 1,444/1,444 tests across 141 files; TypeScript; ordinary, Pages, and canonical-root production builds
• rendered browser: 14 WebGL cases, 25 journey checks, three hash-pinned castle LOD comparisons, and clean manual desktop/phone/short-landscape console review
• auth bridge: 175/175 tests, typecheck, dependency audit, Wrangler dry run
• SpacetimeDB: 121/121 tests, module build, generated binding/private-table checks
• additive migration: exact refs 0-18 and existing rows preserved; private ref 19 appended; actual module one-quantum collection and guarded backfill lifecycle passed; artifact SHA-256 0567aafa5b809b53615fdad29d0190de5903893a8464c224a1a9d8a92fc5bbfb
• assets/licensing: 33 runtime assets, 4 provenance masters, file-size and licence policy checks
• dependencies: zero known root/auth/SpacetimeDB vulnerabilities; 190 registry signatures and 61 attestations verified

Hosted evidence

Verify, auth-bridge, SpacetimeDB, CodeQL analysis, and CodeQL all passed on exact draft head 94ab995c2214fe01cfd57bb20ec022b70fdfbca6.

Remaining gates

• independent review and protected-main merge
• fresh explicit owner approval for each production publication, backfill, and deployment stage