feat: offline mode and static GitHub Pages build

[madjin]

Summary

• Add offline mode (?mode=offline) for fully client-side operation
• Add static build for GitHub Pages deployment (npm run static:build)
• Add connection policy layer with direct mode (?connect=ws://...) for localhost
• Make PUBLIC_WS_URL optional on server (HTTP-only mode with warning)
• Sanitize WebSocket URLs to prevent auth token leakage
• Add connection UI in sidebar with status display

Non-breaking

Existing deployments with current .env settings behave identically. All new features are additive.

Depends on #159 (maintenance/docs split out for easier review).

Test plan

• npm run dev — server starts, world loads, multiplayer works
• ?mode=offline — client boots without WebSocket
• npm run static:build — produces working offline client in build/static/
• Remove PUBLIC_WS_URL — server starts HTTP-only with warning
• ?connect=ws://localhost:3000/ws — direct connect works on localhost

Replaces #158 (same changes, cleaner history).

🤖 Generated with Claude Code

[madjin]

Breaking change analysis

Reviewed every runtime code change against upstream dev. No breaking changes found.

Server (src/server/index.js)

• PUBLIC_WS_URL goes from required → optional. Existing deploys with it set: identical behavior. Without it: now starts in HTTP-only mode instead of crashing.

Client (src/client/index.js)

• Default path (no query params, PUBLIC_WS_URL set in env): resolves to mode=direct, passes wsUrl to Client — same as the current <Client wsUrl={env.PUBLIC_WS_URL} />.

ClientNetwork (src/core/systems/ClientNetwork.js)

• send() adds a WebSocket readyState guard — prevents crash on disconnect, no-op when connected normally.
• this.isServer explicitly set to false (was undefined, already falsy everywhere it's checked).
• this.maxUploadSize set to 0 (was undefined), then overwritten by server snapshot on connect. No functional difference.
• getTime() uses ?? 0 fallback — same result when serverTimeOffset is a number.

world-client.js

• Online mode: only difference is await on world.init() and assetsUrl: undefined passed in config. Offline bootstrap block only runs when wsUrl is falsy.

Apps.js

• Adds world.isOffline getter. Purely additive — no existing code references it.

TL;DR: Existing deployments with current .env settings behave identically after merge. All new functionality (offline mode, static build, connection UI) is additive and opt-in via query params or env vars.