Prep v1 launch: client-auth online (Spark), AI fixes, security, cleanup

Online multiplayer (works on the free Spark plan, no Blaze/Cloud Functions):
- Convert to client-authoritative resolution: the defender resolves each shot
  on-device and settles turn/winner. database.rules.json now permits this while
  preserving the invariants that don't need a trusted server — ship boards stay
  private, only the two participants can touch a game, shot coordinates are locked
  after firing, a shooter cannot forge its own result, and winner/turn must be a
  real participant.
- Add SERVER_AUTHORITATIVE flag (false) so the client skips the (absent) Cloud
  Functions and resolves locally. Flip to true after upgrading to Blaze + deploying
  functions to restore server-side anti-cheat.
- Update rules-tests to cover the client-authoritative model.

AI:
- Fix Medium AI targeting: derive lock direction from the second hit and walk the
  full hit-line from the origin (no longer strands a half-sunk ship), and fully
  reset targeting state on exhaustion (no stale state bleeding across ships).
  Guarded by new regression tests.
- Replace generateAiPlacements' uncapped retry loop with GameEngine.autoPlace()
  (guaranteed termination, honours adjacency mode).

Security:
- Harden resolveShot Cloud Function: resolve from the stored shot coordinates and
  refuse to re-resolve an already-resolved shot (for the future Blaze path).

Play Games:
- Remove the unused leaderboard/achievement code and the placeholder 000000000000
  App ID for v1 (dead code + latent SDK-init crash risk).

Repo hygiene:
- Remove graphify-out/ cache, smoke screenshots, stray scripts and zero-byte
  artifacts; untrack the confidential security-audit docs (kept on disk); ignore
  node_modules/, logs and crash dumps; commit function/rules-tests lockfiles.
- Keep PRODUCTION-CHECKLIST.md current with the Spark deploy path.

Author: Mannava-Daasaradhi

.gitignore

@@ -31,3 +31,21 @@ build-logic/convention/bin/
 core/ai/bin/
 core/domain/bin/
 .kotlin/
+
+# Node (Cloud Functions + Firebase rules tests)
+node_modules/
+
+# Logs & JVM crash dumps
+*.log
+hs_err_pid*.log
+replay_pid*.log
+
+# Local tooling artifacts (knowledge-graph cache, smoke screenshots, one-off scripts)
+graphify-out/
+.graphify_python
+.smoke_*.png
+fix_icons.py
+
+# Internal security-audit docs — do NOT publish in a public repo (kept locally only)
+security-audit-report.md
+security-audit-summary.md