fix: 13 bugs found via systematic code review and testing

Multiplayer:
- Add WaitingScreen between class select and game start; previously
  selecting a class immediately started the game and locked the room,
  preventing other players from joining
- Add periodic lobby room list refresh (2s interval)
- Add LeaveRoom method for backing out of waiting room

Combat & mechanics:
- Mark invalid attack targets with TargetIdx=-1 to suppress misleading
  "0 dmg" combat log entries
- Make Freeze effect actually skip frozen player's action (was purely
  cosmetic before - expired during tick before action processing)
- Implement Life Siphon relic heal-on-damage effect (was defined but
  never applied in combat)
- Fix combo matching to track used actions and prevent reuse

Game modes:
- Wire up weekly mutations to GameSession via ApplyWeeklyMutation()
- Implement 3 mutation runtime effects: no_shop, glass_cannon, elite_flood
- Pass HardMode toggle from lobby UI through Context to GameSession
- Apply HardMode difficulty multipliers (1.5x monsters, 2x shop, 0.5x heal)

Polish:
- Set starting room (index 0) to always be Empty (safe start)
- Distinguish shop purchase errors: "Not enough gold" vs "Inventory full"
- Record random events in codex for discovery tracking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

combat/combo.go

@@ -75,10 +75,12 @@ func DetectCombos(actions map[string]ComboAction) []ComboDef {
 }
 
 func matchesCombo(required []ComboAction, actions map[string]ComboAction) bool {
+	used := make(map[string]bool)
 	for _, req := range required {
 		found := false
-		for _, act := range actions {
-			if act.Class == req.Class && act.ActionType == req.ActionType {
+		for id, act := range actions {
+			if !used[id] && act.Class == req.Class && act.ActionType == req.ActionType {
+				used[id] = true
 				found = true
 				break
 			}