Add lobby/match-start matchmaking flow with additive scene management

Replace the connection-approval role selection with a server-authoritative
match flow built on NGO additive scene management:

- Scenes: Main is the persistent foundation (NetworkManager, GameModeManager,
  cameras, HUD); Lobby and Test Map load/unload additively. Add Lobby + Test Map
  to the build settings; remove the obsolete SampleScene.
- MatchManager (plain MonoBehaviour singleton): loads Lobby on server start,
  StartMatchTrigger lets the host start the match, rolls one random Hunter (rest
  Hider), swaps Lobby -> Test Map (strictly serialized per NGO), respawns each
  player as its role variant. Forces additive client sync mode so clients keep
  Main instead of single-loading it (fixes "Destination scene is not valid").
- Server-driven spawning: null out NetworkConfig.PlayerPrefab at runtime to
  disable auto-spawn, then spawn players after the lobby floor exists (fixes
  falling through the floor) with double-spawn and transition guards.
- StartMatchTrigger: server-gated OnTriggerEnter, only the host's own player
  starts the match.
- NetworkBootstrap: drop role selection / connection approval; everyone spawns
  as the neutral Player prefab. Host/Client/Server/Shutdown buttons stay.
- NetworkPlayerSetup.ScopedModes flag (baked on Hunter/Hider prefabs): lobby
  avatar gets the full mode set, match variants get the role-scoped set.
- GameModeManager.BindLocalPlayer reads ScopedModes and rebinds the painter
  unconditionally (fixes stale painter binding on respawn -> brush painting in
  every mode).
- MeshPainter.PaintingEnabled defaults to false (unbound/pre-spawn/remote never
  paints); PaintHud visibility now also gates on a bound painter (fixes the HUD
  showing at startup before any avatar exists).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Assets/Scripts/StartMatchTrigger.cs

@@ -0,0 +1,26 @@
+using Unity.Netcode;
+using UnityEngine;
+
+/// <summary>
+/// Sits on the Lobby's "Start Match" trigger volume (a BoxCollider with isTrigger on). When the HOST's
+/// own player walks in, it asks the <see cref="MatchManager"/> to start the match. Server-gated: pure
+/// clients fire nothing (IsServer is false there), and only the host-owned player object counts, so a
+/// remote avatar passing through never starts the match. The trigger lives in the additively-loaded
+/// Lobby and is destroyed when the lobby unloads, so it cannot start a second match.
+/// </summary>
+[RequireComponent(typeof(Collider))]
+[DisallowMultipleComponent]
+public class StartMatchTrigger : MonoBehaviour
+{
+    private void OnTriggerEnter(Collider other)
+    {
+        var nm = NetworkManager.Singleton;
+        if (!nm || !nm.IsServer) return; // only the server/host starts the match
+
+        var netObj = other.GetComponentInParent<NetworkObject>();
+        if (!netObj || !netObj.IsPlayerObject) return;        // must be a player avatar
+        if (netObj.OwnerClientId != nm.LocalClientId) return; // ...and specifically the host's own
+
+        if (MatchManager.Instance) MatchManager.Instance.StartMatch();
+    }
+}