chore: community feedback fixes and UI improvements (#102)

## Summary

Addresses all community feedback tickets from the last deploy, plus several UI improvements made during the same session.

### Bug fixes & balance
- **#97** — Fix auto-adventurer tier priority: sort by combat power instead of current cost so the highest-tier affordable unit is always purchased
- **#98** — Add Dark Templar adventurer (80k CP) to bridge the Volcanic Depths progression wall; rewire upgrade and quest rewards accordingly
- **#99** — Reorder and buff Shadow Assassin (55k CP, level 12) so Witch Coven feels rewarding rather than a regression
- **#100** — Display effective Gold/s (all multipliers applied) in the resource bar
- **#101** — Add Peasant tier 2 (10x, essence) and tier 3 (50x, crystals) upgrades for meaningful late-game scaling

### Other fixes
- Sync game state to server before auto-boss challenges (matching manual challenge behaviour)
- Refresh Discord avatar hash on every game load via bot token so stale CDN URLs are corrected automatically

### UI improvements
- Replace Donate / Discord / Support / View Profile / Edit Profile buttons with a single avatar dropdown menu
- Collapse all resources except Gold into a click-to-toggle dropdown; orange alert dot appears when a hidden resource is capped

## Closes

Closes #97
Closes #98
Closes #99
Closes #100
Closes #101

Reviewed-on: #102
Co-authored-by: Hikari <hikari@nhcarrigan.com>
Co-committed-by: Hikari <hikari@nhcarrigan.com>

apps/api/src/services/discord.ts

@@ -106,6 +106,40 @@ const fetchDiscordUser = async(
   }
 };
 
+/**
+ * Fetches a Discord user's profile by their Discord ID using the bot token.
+ * Returns null on any failure so callers are never blocked by Discord API issues.
+ * @param discordId - The Discord user ID to look up.
+ * @returns The Discord user object, or null if the fetch fails.
+ */
+const fetchDiscordUserById = async(
+  discordId: string,
+): Promise<DiscordUser | null> => {
+  const botToken = process.env.DISCORD_BOT_TOKEN;
+  if (botToken === undefined || botToken === "") {
+    return null;
+  }
+  try {
+    const response = await fetch(
+      `https://discord.com/api/v10/users/${discordId}`,
+      { headers: { Authorization: `Bot ${botToken}` } },
+    );
+    if (!response.ok) {
+      return null;
+    }
+    /* eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- Response JSON matches DiscordUser shape */
+    return await (response.json() as Promise<DiscordUser>);
+  } catch (error) {
+    void logger.error(
+      "discord_fetch_user_by_id",
+      error instanceof Error
+        ? error
+        : new Error(String(error)),
+    );
+    return null;
+  }
+};
+
 /**
  * Builds the Discord OAuth authorisation URL.
  * @returns The full OAuth URL to redirect the user to.
@@ -133,4 +167,4 @@ const buildOAuthUrl = (): string => {
 };
 
 export type { DiscordTokenResponse, DiscordUser };
-export { buildOAuthUrl, exchangeCode, fetchDiscordUser };
+export { buildOAuthUrl, exchangeCode, fetchDiscordUser, fetchDiscordUserById };