feat: comprehensive balance and bug fix pass (#240)

## Summary

- **fix(#148)**: Boss fights now return a fresh HMAC signature in the response; both the manual and auto-boss paths update `signatureReference` from it, ending the signature-mismatch loop that stopped auto-boss after the first fight
- **fix(#145)**: Militia `baseCost` lowered from 100g → 65g, smoothing the peasant→militia jump from 10× to ~6.5×
- **fix(#144)**: `crystal_shard` buffed from `1.65×/1.2×` → `1.9×/1.3×` — now competitive as an epic trinket
- **fix(#142)**: Click-power recipe progression smoothed across zones 13–18 and ceiling raised: z13 1.20→1.22, z15 1.22→1.25, z17 1.25→1.28, z18 1.28→1.30
- **close(#143)**: `elder_bark_shield` (1.2×), `void_fragment_amulet` (1.15×), and `soul_bound_catalyst` (1.2×) are all already at or above their target values from a prior pass

Closes #148
Closes #145
Closes #144
Closes #142

Reviewed-on: #240
Co-authored-by: Hikari <hikari@nhcarrigan.com>
Co-committed-by: Hikari <hikari@nhcarrigan.com>

apps/api/test/routes/boss.spec.ts

@@ -340,6 +340,37 @@ describe("boss route", () => {
     expect(area?.status).toBe("locked");
   });
 
+  it("includes HMAC signature in response when ANTI_CHEAT_SECRET is set", async () => {
+    process.env.ANTI_CHEAT_SECRET = "test_secret";
+    const state = makeState({
+      bosses:      [makeBoss()] as GameState["bosses"],
+      adventurers: [makeAdventurer()] as GameState["adventurers"],
+      zones:       [],
+    });
+    vi.mocked(prisma.gameState.findUnique).mockResolvedValueOnce({ state } as never);
+    vi.mocked(prisma.gameState.update).mockResolvedValueOnce({} as never);
+    const res = await challenge({ bossId: "test_boss" });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { signature: string | undefined };
+    expect(body.signature).toBeDefined();
+    delete process.env.ANTI_CHEAT_SECRET;
+  });
+
+  it("omits signature in response when ANTI_CHEAT_SECRET is not set", async () => {
+    delete process.env.ANTI_CHEAT_SECRET;
+    const state = makeState({
+      bosses:      [makeBoss()] as GameState["bosses"],
+      adventurers: [makeAdventurer()] as GameState["adventurers"],
+      zones:       [],
+    });
+    vi.mocked(prisma.gameState.findUnique).mockResolvedValueOnce({ state } as never);
+    vi.mocked(prisma.gameState.update).mockResolvedValueOnce({} as never);
+    const res = await challenge({ bossId: "test_boss" });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { signature: string | undefined };
+    expect(body.signature).toBeUndefined();
+  });
+
   it("returns 500 when the database throws", async () => {
     vi.mocked(prisma.gameState.findUnique).mockRejectedValueOnce(new Error("DB error"));
     const res = await challenge({ bossId: "test_boss" });