fix: 13 bugs found via systematic code review and testing

Multiplayer:
- Add WaitingScreen between class select and game start; previously
  selecting a class immediately started the game and locked the room,
  preventing other players from joining
- Add periodic lobby room list refresh (2s interval)
- Add LeaveRoom method for backing out of waiting room

Combat & mechanics:
- Mark invalid attack targets with TargetIdx=-1 to suppress misleading
  "0 dmg" combat log entries
- Make Freeze effect actually skip frozen player's action (was purely
  cosmetic before - expired during tick before action processing)
- Implement Life Siphon relic heal-on-damage effect (was defined but
  never applied in combat)
- Fix combo matching to track used actions and prevent reuse

Game modes:
- Wire up weekly mutations to GameSession via ApplyWeeklyMutation()
- Implement 3 mutation runtime effects: no_shop, glass_cannon, elite_flood
- Pass HardMode toggle from lobby UI through Context to GameSession
- Apply HardMode difficulty multipliers (1.5x monsters, 2x shop, 0.5x heal)

Polish:
- Set starting room (index 0) to always be Empty (safe start)
- Distinguish shop purchase errors: "Not enough gold" vs "Inventory full"
- Record random events in codex for discovery tracking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

game/lobby.go

@@ -161,6 +161,25 @@ func (l *Lobby) JoinRoom(code, playerName, fingerprint string) error {
 	return nil
 }
 
+func (l *Lobby) LeaveRoom(code, fingerprint string) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	room, ok := l.rooms[code]
+	if !ok {
+		return
+	}
+	for i, p := range room.Players {
+		if p.Fingerprint == fingerprint {
+			room.Players = append(room.Players[:i], room.Players[i+1:]...)
+			break
+		}
+	}
+	// Remove empty waiting rooms
+	if len(room.Players) == 0 && room.Status == RoomWaiting {
+		delete(l.rooms, code)
+	}
+}
+
 func (l *Lobby) SetPlayerClass(code, fingerprint, class string) {
 	l.mu.Lock()
 	defer l.mu.Unlock()