feat: UNO-style table, social hub, cosmetics, speed mode, store IAB

Game table & play
- UNO-style restyle: suit-aware bolder cards (+xl size), pulsing playable glow,
  big "YOUR TURN" pill, active-seat ring, trick-win particle burst, round
  confetti, match coin-rain.
- Per-league turn time via turnMsForStake: 15s starter/AI, 10s pro, 7s expert;
  mirrored server-side in GameRoom.TurnMs.
- Speed (Blitz) mode for vs-AI/private: 5s turns, race to 5, ~halved pacing.
- Matchmaking waits ~15s (randomized 12-18s) then fills bots; elapsed timer + hint.

Rewards / gifts
- Richer post-match modal (floating coins, XP bar), celebration overlay reveals
  the unlocked sticker pack, boosted daily rewards (client+server synced),
  themed 7-day daily with special day-7.

Social
- Public profile modal (identity, stats, achievement board) from leaderboard /
  friends / discover / end-of-game roster; rate-limited add-friend (10/hour).
- Social hub: Friends / Discover (player search + suggestions) / Messages inbox.
- Profile gender (shown in finder/profile) + social links with public/friends/
  hidden visibility, enforced server-side.

Cosmetics
- Distinct card backs: per-design pattern families (stripes/argyle/grid/dots/
  rays/scales/crosshatch/royal/filigree/gem) + luxury motifs (lib/cardBack.ts),
  consistent on table/shop/profile; +Peacock/Rose-Gold backs.
- Purchasable titles (shop Titles section); title shown under the seat on the
  table and in discover/public profile.
- 10 new sticker packs (banter/kol-kol, Persian trends, court cards, moods).
- Persistent level+XP bar on Home and every inner screen.

Payments
- Buy-coins gateway opens in a new tab (no SPA dead-end) + focus refresh.
- Store IAB scaffolding: Cafe Bazaar deep-link purchase + redirect-token capture,
  Myket native-bridge contract, server-side IabService.Verify for both stores,
  config-driven via Iab__* env. POST /api/coins/iab/verify (JWT).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/ENV_FILE.example

@@ -40,3 +40,18 @@ ZARINPAL_MERCHANT_ID=299685fb-cadf-4dfc-98e2-d4af5d81528d
 ZARINPAL_SANDBOX=true
 ZARINPAL_CALLBACK_URL=http://localhost:1505/api/coins/pay/callback
 ZARINPAL_CLIENT_RETURN_URL=http://localhost:1500
+
+# Store in-app billing (Cafe Bazaar / Myket) — fill from the developer panels.
+# SKU == coin-pack id (p1/p2/…). Coins are credited only after the purchase
+# token verifies server-to-server.
+IAB_PACKAGE_NAME=com.bargevasat.hokm
+# Cafe Bazaar (pardakht dev API): create an OAuth client, do the one-time consent
+# to obtain a refresh_token. https://pardakht.cafebazaar.ir/
+IAB_BAZAAR_CLIENT_ID=
+IAB_BAZAAR_CLIENT_SECRET=
+IAB_BAZAAR_REFRESH_TOKEN=
+# Myket developer panel → API access token.
+IAB_MYKET_ACCESS_TOKEN=
+# DEV ONLY: credit purchases WITHOUT verifying (set true to test before you have
+# store creds). NEVER true in production.
+IAB_ALLOW_UNVERIFIED=false