feat(web): use the shared high-score service

Keep browser settings and the existing local save fallback, but route the
browser high-score table through the same-origin service when it is available.
The WASM storage bridge now accepts fetched score JSON and queues one validated
submission at a time. The JavaScript plugin fetches the canonical table,
submits accepted name-entry scores, ignores stale responses, retries failures,
and feeds successful responses back into the running game.

Update the web and project documentation to describe the optional shared
leaderboard and regenerate the tracked browser artifact. A missing service
continues to leave the local table usable; the service documentation records
that anonymous client scores are intentionally not tamper-resistant.

Test Plan:
- `just test` -- passed (3 service tests and 137 game tests)
- `just clippy` -- passed
- `just web-build` -- passed
- `cargo +nightly fmt -- --check` -- passed
- `node --check web/storage.js` and `prettier --check web/storage.js` -- passed
- `rumdl check --flavor commonmark CHANGELOG.md README.md web/README.md highscore-server/README.md` -- passed
- Browser WASM load through same-origin API proxy -- passed
- `git diff --cached --check` -- passed

tdkpin-rs/web/README.md

@@ -8,9 +8,13 @@ just web-serve
 
 The game is compiled for `wasm32-unknown-unknown` and loaded into a fixed
 640x460 canvas centered on the black page by `index.html`. Browser settings and
-high scores are saved in `localStorage`; native builds continue to use their
-normal per-user save file.
+a fallback copy of the high-score table are saved in `localStorage`; native
+builds continue to use their normal per-user save file.
 
 The page uses Macroquad's official browser loader from the miniquad samples
 site. The web page must be served over HTTP rather than opened directly from a
 `file:` URL.
+
+When the same-origin `/api/highscores` endpoint is available, the browser loads
+and submits the shared top-ten table there. The small Axum service and an nginx
+proxy example are in [highscore-server](../highscore-server/).

tdkpin-rs/web/storage.js

@@ -4,7 +4,12 @@
   const storageKey = "tdkpin.save.v1";
   const encoder = new TextEncoder();
   const decoder = new TextDecoder();
+  const highScoreApi = "/api/highscores";
   let lastRevision = 0;
+  let lastHighScoreRevision = 0;
+  let highScoreRequestInFlight = false;
+  let highScoreGeneration = 0;
+  let highScoreSubmissionWarningShown = false;
 
   function browserStorage() {
     try {
@@ -54,10 +59,81 @@
     lastRevision = revision;
   }
 
+  function deliverHighScores(json) {
+    wasm_exports.tdkpin_browser_high_scores_clear();
+    for (const byte of encoder.encode(json)) {
+      wasm_exports.tdkpin_browser_high_scores_push(byte);
+    }
+    wasm_exports.tdkpin_browser_high_scores_finish();
+  }
+
+  async function fetchHighScores() {
+    const generation = ++highScoreGeneration;
+    try {
+      const response = await fetch(highScoreApi, {
+        cache: "no-store",
+        headers: { Accept: "application/json" },
+      });
+      if (!response.ok) {
+        throw new Error(`high-score request failed (${response.status})`);
+      }
+      const json = await response.text();
+      if (generation === highScoreGeneration) {
+        deliverHighScores(json);
+      }
+    } catch (error) {
+      console.warn("shared high scores unavailable; using local scores", error);
+    }
+  }
+
+  async function flushHighScoreSubmission() {
+    if (highScoreRequestInFlight) {
+      return;
+    }
+    const revision = wasm_exports.tdkpin_browser_high_score_revision();
+    if (revision === lastHighScoreRevision) {
+      return;
+    }
+    const bytes = new Uint8Array(
+      wasm_exports.tdkpin_browser_high_score_length(),
+    );
+    for (let index = 0; index < bytes.length; index += 1) {
+      bytes[index] = wasm_exports.tdkpin_browser_high_score_byte(index);
+    }
+
+    highScoreRequestInFlight = true;
+    try {
+      const response = await fetch(highScoreApi, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: decoder.decode(bytes),
+        keepalive: true,
+      });
+      if (!response.ok) {
+        throw new Error(`high-score submission failed (${response.status})`);
+      }
+      const json = await response.text();
+      highScoreGeneration += 1;
+      deliverHighScores(json);
+      wasm_exports.tdkpin_browser_high_score_ack(revision);
+      lastHighScoreRevision = revision;
+      highScoreSubmissionWarningShown = false;
+    } catch (error) {
+      if (!highScoreSubmissionWarningShown) {
+        console.warn("shared high-score submission failed; will retry", error);
+        highScoreSubmissionWarningShown = true;
+      }
+    } finally {
+      highScoreRequestInFlight = false;
+    }
+  }
+
   function onInit() {
     sendSavedDataToRust();
     lastRevision = wasm_exports.tdkpin_browser_storage_save_revision();
+    void fetchHighScores();
     window.setInterval(flushRustSave, 50);
+    window.setInterval(() => void flushHighScoreSubmission(), 50);
     window.addEventListener("beforeunload", flushRustSave);
   }