Harden multiplayer damage authority

[agustin-lowpoly]

Summary:

• Keep the cssQuake SEO metadata/title updates.
• Move multiplayer combat to stricter server authority for repeated damage, moving targets, projectiles, pickups, respawn, and remote pain/attack/death presentation.
• Add focused multiplayer browser coverage; default deep checks now run the core two-client release gate, with world/spawn/lifecycle checks behind --extended.

Tests:

• node --check test/browser/runMultiplayerDeepChecks.mjs
• pnpm build
• pnpm test
• node test/browser/runMultiplayerDeepChecks.mjs --json-out bench/results/quake/multiplayer-deep-checks-core-after-prune.json (20/20, page errors 0, request failures 0)