feat: comprehensive balance and bug fix pass (#240)

## Summary

- **fix(#148)**: Boss fights now return a fresh HMAC signature in the response; both the manual and auto-boss paths update `signatureReference` from it, ending the signature-mismatch loop that stopped auto-boss after the first fight
- **fix(#145)**: Militia `baseCost` lowered from 100g → 65g, smoothing the peasant→militia jump from 10× to ~6.5×
- **fix(#144)**: `crystal_shard` buffed from `1.65×/1.2×` → `1.9×/1.3×` — now competitive as an epic trinket
- **fix(#142)**: Click-power recipe progression smoothed across zones 13–18 and ceiling raised: z13 1.20→1.22, z15 1.22→1.25, z17 1.25→1.28, z18 1.28→1.30
- **close(#143)**: `elder_bark_shield` (1.2×), `void_fragment_amulet` (1.15×), and `soul_bound_catalyst` (1.2×) are all already at or above their target values from a prior pass

Closes #148
Closes #145
Closes #144
Closes #142

Reviewed-on: #240
Co-authored-by: Hikari <hikari@nhcarrigan.com>
Co-committed-by: Hikari <hikari@nhcarrigan.com>

apps/api/src/routes/boss.ts

@@ -9,6 +9,7 @@
 /* eslint-disable complexity -- Boss handler has inherent complexity */
 /* eslint-disable stylistic/max-len -- Long lines in combat logic */
 /* eslint-disable max-lines -- Boss route with full combat logic and helpers exceeds line limit */
+import { createHmac } from "node:crypto";
 import {
   computeSetBonuses,
   getActiveCompanionBonus,
@@ -25,6 +26,17 @@ import { updateChallengeProgress } from "../services/dailyChallenges.js";
 import { logger } from "../services/logger.js";
 import type { HonoEnvironment } from "../types/hono.js";
 
+/**
+ * Computes the HMAC-SHA256 of data using the given secret.
+ * @param data - The data string to sign.
+ * @param secret - The HMAC secret key.
+ * @returns The hex-encoded HMAC digest.
+ */
+const computeHmac = (data: string, secret: string): string => {
+  return createHmac("sha256", secret).update(data).
+    digest("hex");
+};
+
 /**
  * Exponential base for the prestige combat multiplier: Math.pow(base, prestigeCount).
  * Replaces the former linear formula (1 + count * 0.1) to enable late-game zone progression.
@@ -379,6 +391,11 @@ bossRouter.post("/challenge", async(context) => {
       where: { discordId },
     });
 
+    const secret = process.env.ANTI_CHEAT_SECRET;
+    const updatedSignature = secret === undefined
+      ? undefined
+      : computeHmac(JSON.stringify(state), secret);
+
     const { bossId } = body;
     void logger.metric("boss_challenge", 1, { bossId, discordId, won });
 
@@ -401,6 +418,9 @@ bossRouter.post("/challenge", async(context) => {
     if (casualties !== undefined) {
       response.casualties = casualties;
     }
+    if (updatedSignature !== undefined) {
+      response.signature = updatedSignature;
+    }
 
     return context.json(response);
   } catch (error) {