P14c: targeted private share (handout/note/image) from the roster

- GM clicks a player's 📨 in the session roster → composer (title/body/image via
  resizeToMax) → sendPrivateHandout to that player only (server-routed; non-
  recipients never receive it). Covers "share a secret map/note to the scout".
- The recipient sees a prominent "📨 Just for you" card on their player view
  (PlayerBoards renders playerSessionStore.privateHandout, image inline).
- Realtime e2e: GM shares a private note; only the targeted player sees it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

e2e-realtime/realtime.spec.ts

@@ -66,6 +66,13 @@ test('GM hosts a session; a player on another device sees live combat', async ({
   await player.getByRole('button', { name: 'Send' }).click();
   await expect(gm.getByText('Hello GM')).toBeVisible();
 
+  // Targeted share: the GM sends a private note to the player; only they see it.
+  await gm.getByRole('button', { name: /Share with/ }).click();
+  await gm.getByLabel('Share title').fill('Secret passage');
+  await gm.getByRole('button', { name: /Send to/ }).click();
+  await expect(player.getByText('📨 Just for you')).toBeVisible();
+  await expect(player.getByText('Secret passage')).toBeVisible();
+
   await gmCtx.close();
   await playerCtx.close();
 });