Share a link that plays the game without the editor (#266)

A project could only be played inside the editor, behind the login.
To show a game to someone else there was no way short of an account.
A release freezes the saved project under a random token and serves
it on a page that holds nothing but the game view.

- Menu -> Release... opens a dialog with the state of the release,
  the link with Copy link and Open, Publish or Update release, and
  Take down behind a confirmation.
- Publish saves first and refuses while anything is unsaved, like
  snapshots. Updating keeps the link. Take down kills it, and a new
  Publish hands out a new token.
- The link is play.html?game=<32 hex>. The page needs no session,
  paints Theme.colors.background, zooms with Auto and waits for
  "Click to play" so that sound and keyboard focus are allowed.
- The game always starts in the start scene. Persistent variables
  are stored per link in the browser. Plugins are not loaded, and the
  dialog warns about them and about a project without a scene.
- GET ?r=releases/{token} is the only route besides auth/* that works
  without a login. The public answer carries the token as project.id,
  so the project id stays hidden. Release files are written with 0640
  and nginx does not serve them directly (measured 403).
- Starting, the frame and Load scene moved into runtime/GameRun.ts.
  Play in the editor and the play page run through the same code.
- WorldViewport moved to src/viewport/ and no longer needs the
  EditorState. Pointer forwarding (gamePointer.ts) and setting up
  textures, fonts and sounds (projectFiles.ts) exist only once.
- Vite builds two pages. The play page loads 4 kB of its own code
  plus the shared chunk (Pixi, runtime, drawing, 653 kB) and Rapier,
  without the editor.

Found on the way, not fixed here: data/projects/<id>.json answers 200
without a login because the files are 0644.

Tests:
- ./check.sh: 194 files, 2808 tests, exit 0.
- tests/php/releases.test.php: 20 checks, also added to CI.
- New e2e module 60 with 10 checks, played in a browser without a
  session. Module 46 counts the menu entries and was updated.
- Full e2e run: 1572 checks passed.
- Counter-checks: 3 unit, 2 PHP and 3 browser mutations all fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/index.php

@@ -31,7 +31,7 @@ declare(strict_types=1);
  *   POST   ?r=projects          {name}               → {id,name,revision,updatedAt,project}
  *   GET    ?r=projects/{id}     → {id,name,revision,updatedAt,project}
  *   PUT    ?r=projects/{id}     {revision, project}  → {revision,updatedAt} | 409 {error,revision}
- *   DELETE ?r=projects/{id}     → 204                (its snapshots go with it)
+ *   DELETE ?r=projects/{id}     → 204                (its snapshots and its release go with it)
  *
  *   GET    ?r=projects/{id}/snapshots             → [{id,name,revision,createdAt}], newest first
  *   POST   ?r=projects/{id}/snapshots             {name?}    → 201 {id,name,revision,createdAt}
@@ -40,6 +40,15 @@ declare(strict_types=1);
  *                               (a snapshot copies the project as stored; restoring keeps the
  *                                stand it replaces as the snapshot `before`, #231)
  *
+ *   GET    ?r=projects/{id}/release    → {token,revision,publishedAt} | null
+ *   POST   ?r=projects/{id}/release    → {token,revision,publishedAt}   (publishes the stored project)
+ *   DELETE ?r=projects/{id}/release    → 204 | 404
+ *                               (one link per project, kept when publishing again, #266)
+ *
+ * Released games are the one thing open to everybody, the token being the key:
+ *
+ *   GET    ?r=releases/{token}         → {name,publishedAt,project} | 404
+ *
  *   GET    ?r=textures            → [{file,name,width,height,bytes,updatedAt}]
  *   POST   ?r=textures&name=x.png raw image bytes    → {file,name,width,height,bytes}
  *   DELETE ?r=textures/{file}     → 204
@@ -70,6 +79,7 @@ require __DIR__ . '/lib/FontStore.php';
 require __DIR__ . '/lib/OriginalName.php';
 require __DIR__ . '/lib/PixelStore.php';
 require __DIR__ . '/lib/PluginStore.php';
+require __DIR__ . '/lib/ReleaseStore.php';
 require __DIR__ . '/lib/Response.php';
 require __DIR__ . '/lib/SessionStore.php';
 require __DIR__ . '/lib/SnapshotStore.php';
@@ -180,6 +190,10 @@ function routeProjects(array $parts, string $method, string $owner, bool $seesAl
     if (($parts[2] ?? null) === 'snapshots') {
         routeSnapshots($parts, $method, $store, $snapshots, $id);
     }
+    $releases = new ReleaseStore(dirname(__DIR__) . '/data/releases');
+    if (($parts[2] ?? null) === 'release' && count($parts) === 3) {
+        routeRelease($method, $store, $releases, $id);
+    }
     if (count($parts) > 2) {
         Response::error('Not found', 404);
     }
@@ -213,6 +227,7 @@ function routeProjects(array $parts, string $method, string $owner, bool $seesAl
             Response::error('Project not found', 404);
         }
         $snapshots->deleteAll($id);
+        $releases->takeDown($id);
         Response::noContent();
     }
 
@@ -289,6 +304,46 @@ function routeSnapshots(array $parts, string $method, Store $store, SnapshotStor
     Response::json(['revision' => $result['revision'], 'updatedAt' => $result['updatedAt'], 'before' => $before]);
 }
 
+/**
+ * The released copy of one project (#266). Whoever may load the project may publish it, update it
+ * and take it down; publishing copies the project as stored, not what a tab has not saved yet.
+ */
+function routeRelease(string $method, Store $store, ReleaseStore $releases, string $id): never
+{
+    $doc = $store->load($id);
+    if ($doc === null) {
+        Response::error('Project not found', 404);
+    }
+    if ($method === 'GET') {
+        Response::json($releases->of($id));
+    }
+    if ($method === 'POST') {
+        Response::json($releases->publish($doc));
+    }
+    if ($method === 'DELETE') {
+        if (!$releases->takeDown($id)) {
+            Response::error('Project is not released', 404);
+        }
+        Response::noContent();
+    }
+    Response::error('Method not allowed', 405);
+}
+
+/** The one route open without a sign-in: a released game, found by its token. */
+function routeReleases(array $parts, string $method): never
+{
+    if ($method !== 'GET' || count($parts) !== 2) {
+        Response::error('Not found', 404);
+    }
+    $release = (new ReleaseStore(dirname(__DIR__) . '/data/releases'))->load($parts[1]);
+    if ($release === null) {
+        Response::error('Game not found', 404);
+    }
+    // The copy goes out under the token, not the project's own id: that one is nobody's business.
+    $project = ['id' => $release['token']] + $release['project'];
+    Response::json(['name' => $release['name'], 'publishedAt' => $release['publishedAt'], 'project' => $project]);
+}
+
 function snapshotName(array $body): string
 {
     $name = trim((string) ($body['name'] ?? ''));
@@ -581,6 +636,9 @@ try {
     if ($parts[0] === 'users') {
         routeUsers($parts, $method, $auth, $users);
     }
+    if ($parts[0] === 'releases') {
+        routeReleases($parts, $method);
+    }
     // Images, fonts, sounds, cels and plugins are shared between accounts; being signed in is still the
     // price of admission, so an uploaded file cannot be dropped in by a stranger.
     $user = $auth->require();