Elemental Showdown: review findings (#158)

[jacobcheatley]

Part of #158. Fixes from a two-axis review (standards and spec) of the whole Elemental Showdown stack, one commit each.

Behaviour

• An IPv4-mapped IPv6 address (::ffff:a.b.c.d) is rate-limited as its IPv4 address; before, every one of them shared the 0:0:0:0 bucket.
• The Voter cookie is set only when a Vote landed, not on a rate-limited attempt.
• The unlock's roster comes from the reloaded aggregate, so the Active filter exists in exactly one place.
• A Matchup reaches the browser as ShownElement (id, name, emoji, colour): Common/Rare never leaves the server.
• Arrow keys move the seam the way they point (Down: the top Element takes ground); aria-valuenow is the seam's height so Up still increases it.
• A browser with no navigator.clipboard logs and leaves the share label alone instead of throwing.
• A drag that starts on the pill is still a drag; a tap on it at rest casts 0 exactly once.

Tidy

• Comments trimmed to what the code cannot say; the reveal's types and revealFor in vote-reveal.ts (no more type cycle); Voter is a branded uuid; matchupKey takes the pair; one Mosaic; one percent, one met colour, one shared test Element factory.

Verification

Every behaviour fix has a test that failed on the old code. bun run check and bun run test green (46 files, 605 tests); the e2e suite passes against the production Docker image; keyboard, drag, pill-tap and reveal driven in headless Chromium against the local database.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AVEtgjCoEbaNHrYfzyCRNH