Web users had no persistent fingerprint, losing codex/achievements/
rankings on reconnect. Now web users enter nickname + password:
- New accounts: set password (min 4 chars, bcrypt hashed)
- Existing accounts: verify password to log in
- On success: deterministic fingerprint SHA256(web:nickname) assigned
- SSH users with real key fingerprints skip password entirely
New files: store/passwords.go, store/passwords_test.go
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Multiplayer:
- Add WaitingScreen between class select and game start; previously
selecting a class immediately started the game and locked the room,
preventing other players from joining
- Add periodic lobby room list refresh (2s interval)
- Add LeaveRoom method for backing out of waiting room
Combat & mechanics:
- Mark invalid attack targets with TargetIdx=-1 to suppress misleading
"0 dmg" combat log entries
- Make Freeze effect actually skip frozen player's action (was purely
cosmetic before - expired during tick before action processing)
- Implement Life Siphon relic heal-on-damage effect (was defined but
never applied in combat)
- Fix combo matching to track used actions and prevent reuse
Game modes:
- Wire up weekly mutations to GameSession via ApplyWeeklyMutation()
- Implement 3 mutation runtime effects: no_shop, glass_cannon, elite_flood
- Pass HardMode toggle from lobby UI through Context to GameSession
- Apply HardMode difficulty multipliers (1.5x monsters, 2x shop, 0.5x heal)
Polish:
- Set starting room (index 0) to always be Empty (safe start)
- Distinguish shop purchase errors: "Not enough gold" vs "Inventory full"
- Record random events in codex for discovery tracking
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
