Add observed multiplayer press core

[Sanokei]

Summary

• add a server-owned observed-press registry for M8 multiplayer
• bind Colyseus room sessions to checksum-valid Kei addresses and ignore client-supplied addresses in press/bank messages
• reserve observed presses once, restore them on issuer failure, and keep distinct players/concurrent banks isolated

Validation

• bun test test/presses.test.ts — 25 pass
• bun test — 71 pass, 1 expected native-node skip
• bun run typecheck — pass
• bun run build — pass
• bun run check — Worker bundle/dry-run success; Wrangler left Windows esbuild service handles open after printing --dry-run: exiting now, so the lingering validation processes were terminated

Scope

Draft checkpoint only. This does not complete M8: server/main.ts and the browser are intentionally not wired to the room yet, and the existing HTTP/single-player path is unchanged. A follow-up should add the WebSocket transport and browser fallback without changing this trust boundary.

[Sanokei]

Substantive review checkpoint: the post-issuance transport rollback bug is fixed in 969ad2b and covered by a regression test. Local validation is green: 72 pass / 1 expected native-node skip, typecheck pass, browser build pass. This PR must remain draft and unmerged because its claimed session binding is not yet an authorization boundary: onJoin only checksum-validates a client-supplied address. A second session or room can join as a known victim address, consume the victim tally from the shared address-keyed registry, and receive or withhold the victim-bound claim proof. That cannot steal the funds, but it can grief the wallet and destroy its claim UX. Require authenticated proof of wallet control, or redesign reservations so an unauthenticated session cannot consume another session claim, before readying this PR.