Share a link that plays the game without the editor (#266)

A project could only be played inside the editor, behind the login.
To show a game to someone else there was no way short of an account.
A release freezes the saved project under a random token and serves
it on a page that holds nothing but the game view.

- Menu -> Release... opens a dialog with the state of the release,
  the link with Copy link and Open, Publish or Update release, and
  Take down behind a confirmation.
- Publish saves first and refuses while anything is unsaved, like
  snapshots. Updating keeps the link. Take down kills it, and a new
  Publish hands out a new token.
- The link is play.html?game=<32 hex>. The page needs no session,
  paints Theme.colors.background, zooms with Auto and waits for
  "Click to play" so that sound and keyboard focus are allowed.
- The game always starts in the start scene. Persistent variables
  are stored per link in the browser. Plugins are not loaded, and the
  dialog warns about them and about a project without a scene.
- GET ?r=releases/{token} is the only route besides auth/* that works
  without a login. The public answer carries the token as project.id,
  so the project id stays hidden. Release files are written with 0640
  and nginx does not serve them directly (measured 403).
- Starting, the frame and Load scene moved into runtime/GameRun.ts.
  Play in the editor and the play page run through the same code.
- WorldViewport moved to src/viewport/ and no longer needs the
  EditorState. Pointer forwarding (gamePointer.ts) and setting up
  textures, fonts and sounds (projectFiles.ts) exist only once.
- Vite builds two pages. The play page loads 4 kB of its own code
  plus the shared chunk (Pixi, runtime, drawing, 653 kB) and Rapier,
  without the editor.

Found on the way, not fixed here: data/projects/<id>.json answers 200
without a login because the files are 0644.

Tests:
- ./check.sh: 194 files, 2808 tests, exit 0.
- tests/php/releases.test.php: 20 checks, also added to CI.
- New e2e module 60 with 10 checks, played in a browser without a
  session. Module 46 counts the menu entries and was updated.
- Full e2e run: 1572 checks passed.
- Counter-checks: 3 unit, 2 PHP and 3 browser mutations all fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/php/releases.test.php

@@ -0,0 +1,77 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * The release store (#266) on a scratch directory. Plain PHP like snapshots.test.php; CI runs it
+ * with `php tests/php/releases.test.php` and reads the last line.
+ */
+
+require __DIR__ . '/../../api/lib/Store.php';
+require __DIR__ . '/../../api/lib/ReleaseStore.php';
+
+$failed = 0;
+$passed = 0;
+
+function check(string $name, bool $ok, mixed $got = null): void
+{
+    global $failed, $passed;
+    if ($ok) {
+        $passed++;
+        echo "PASS  {$name}\n";
+        return;
+    }
+    $failed++;
+    echo "FAIL  {$name}", $got === null ? '' : ' — got ' . json_encode($got), "\n";
+}
+
+$dir = sys_get_temp_dir() . '/game-maker-php-releases-' . bin2hex(random_bytes(4));
+mkdir($dir);
+$releases = new ReleaseStore($dir);
+
+check('a project that was never released has none', $releases->of('p1') === null);
+check('taking down a project without a release says so', $releases->takeDown('p1') === false);
+
+$doc = ['id' => 'p1', 'name' => 'Game', 'revision' => 4, 'project' => ['id' => 'p1', 'assets' => [['id' => 'a']]]];
+$first = $releases->publish($doc);
+check('publishing hands out a 128-bit token', ReleaseStore::isValidToken($first['token']), $first);
+check('the summary names the revision it copied', $first['revision'] === 4, $first);
+check('the project now has that release', $releases->of('p1') === $first, $releases->of('p1'));
+
+$loaded = $releases->load($first['token']);
+check(
+    'the token loads the copy, its name and its project',
+    $loaded !== null && $loaded['project'] === $doc['project'] && $loaded['name'] === 'Game' && $loaded['projectId'] === 'p1',
+    $loaded,
+);
+check('the release file is not readable for the web server', (fileperms("{$dir}/{$first['token']}.json") & 0o007) === 0);
+check('nor is the file that says which link a project has', (fileperms("{$dir}/projects/p1.json") & 0o007) === 0);
+
+$changed = ['revision' => 7, 'project' => ['id' => 'p1', 'assets' => []]] + $doc;
+$second = $releases->publish($changed);
+check('publishing again keeps the link', $second['token'] === $first['token'], $second);
+check('and replaces the copy', $releases->load($first['token'])['project'] === $changed['project']);
+check('with the new revision', $second['revision'] === 7, $second);
+
+$other = $releases->publish(['id' => 'p2'] + $doc);
+check('another project gets another link', $other['token'] !== $first['token']);
+
+check('an unknown token loads nothing', $releases->load(str_repeat('0', 32)) === null);
+check('a token of the wrong shape loads nothing', $releases->load('../projects/p1') === null);
+check('a project id is not a token', $releases->load('p1') === null);
+
+check('taking down a release says so', $releases->takeDown('p1') === true);
+check('the link is dead afterwards', $releases->load($first['token']) === null);
+check('and the project has no release', $releases->of('p1') === null);
+check('the other project keeps its own', $releases->load($other['token']) !== null);
+
+$again = $releases->publish($doc);
+check('publishing after a take-down hands out a new link', $again['token'] !== $first['token'], $again);
+
+foreach (array_merge(glob("{$dir}/projects/*") ?: [], glob("{$dir}/*.json") ?: []) as $file) {
+    unlink($file);
+}
+@rmdir("{$dir}/projects");
+@rmdir($dir);
+
+echo $failed === 0 ? "ALL PASSED – {$passed} checks\n" : "{$failed} FAILED, {$passed} passed\n";
+exit($failed === 0 ? 0 : 1);