Phase 10: accounts + cloud sync + Pathbuilder import

- Lean file-backed accounts (server/src/accounts.ts): scrypt-hashed passwords,
  hashed bearer tokens, per-user backup blob; persisted under DATA_DIR. /api routes
  (register/login/logout, PUT/GET /save) with per-IP throttle + 48MB body limit.
- Client cloud lib + Settings "Cloud sync": sign up / sign in, back up this device,
  restore from cloud (whole-backup push/pull, last-write-wins). Local-first default;
  the assistant key (localStorage) is never part of the synced Dexie backup.
- Pathbuilder 2e import: the existing character import now detects a Pathbuilder
  build JSON and converts it to a PF2e character (abilities/HP/saves/skills).
- Dockerfile creates a node-owned /data; compose mounts a named ttrpg-data volume.
- (Spectator links = existing /play?room=CODE; PDF export = existing Print.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy/ttrpg.compose.yml

@@ -13,7 +13,10 @@ services:
       - PORT=8787
       - STATIC_DIR=/app/dist
       - NODE_ENV=production
+      - DATA_DIR=/data
       - ALLOWED_ORIGINS=https://ttrpg.briggen.dev
+    volumes:
+      - ttrpg-data:/data
     security_opt:
       - no-new-privileges:true
     labels:
@@ -25,6 +28,9 @@ services:
     networks:
       - proxy
 
+volumes:
+  ttrpg-data:
+
 networks:
   proxy:
     external: true