feat: comprehensive balance pass (#239)

- fix: boss signature chain maintained through fight results (#148)
- fix: militia cost curve smoothed (100g -> 65g) (#145)
- fix: crystal_shard buffed to epic tier (1.65x/1.2x -> 1.9x/1.3x) (#144)
- fix: click_power recipe ceiling raised and z13-18 progression smoothed (#142)
- close: elder_bark_shield, void_fragment_amulet, soul_bound_catalyst already at target values (#143)

apps/api/test/routes/boss.spec.ts

@@ -340,6 +340,37 @@ describe("boss route", () => {
     expect(area?.status).toBe("locked");
   });
 
+  it("includes HMAC signature in response when ANTI_CHEAT_SECRET is set", async () => {
+    process.env.ANTI_CHEAT_SECRET = "test_secret";
+    const state = makeState({
+      bosses:      [makeBoss()] as GameState["bosses"],
+      adventurers: [makeAdventurer()] as GameState["adventurers"],
+      zones:       [],
+    });
+    vi.mocked(prisma.gameState.findUnique).mockResolvedValueOnce({ state } as never);
+    vi.mocked(prisma.gameState.update).mockResolvedValueOnce({} as never);
+    const res = await challenge({ bossId: "test_boss" });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { signature: string | undefined };
+    expect(body.signature).toBeDefined();
+    delete process.env.ANTI_CHEAT_SECRET;
+  });
+
+  it("omits signature in response when ANTI_CHEAT_SECRET is not set", async () => {
+    delete process.env.ANTI_CHEAT_SECRET;
+    const state = makeState({
+      bosses:      [makeBoss()] as GameState["bosses"],
+      adventurers: [makeAdventurer()] as GameState["adventurers"],
+      zones:       [],
+    });
+    vi.mocked(prisma.gameState.findUnique).mockResolvedValueOnce({ state } as never);
+    vi.mocked(prisma.gameState.update).mockResolvedValueOnce({} as never);
+    const res = await challenge({ bossId: "test_boss" });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { signature: string | undefined };
+    expect(body.signature).toBeUndefined();
+  });
+
   it("returns 500 when the database throws", async () => {
     vi.mocked(prisma.gameState.findUnique).mockRejectedValueOnce(new Error("DB error"));
     const res = await challenge({ bossId: "test_boss" });

apps/api/test/routes/debug.spec.ts

@@ -597,7 +597,7 @@ describe("debug route", () => {
 
     it("patches adventurer stats when only name has changed (exercises all earlier OR conditions)", async () => {
       const state = makeState({
-        adventurers: [{ id: "militia", count: 5, unlocked: true, baseCost: 100, goldPerSecond: 0.7, essencePerSecond: 0, combatPower: 3, level: 2, name: "Old Name", class: "warrior" }] as GameState["adventurers"],
+        adventurers: [{ id: "militia", count: 5, unlocked: true, baseCost: 65, goldPerSecond: 0.7, essencePerSecond: 0, combatPower: 3, level: 2, name: "Old Name", class: "warrior" }] as GameState["adventurers"],
       });
       vi.mocked(prisma.gameState.findUnique).mockResolvedValueOnce({ state } as never);
       vi.mocked(prisma.gameState.update).mockResolvedValueOnce({} as never);