feat(web): use the shared high-score service

Keep browser settings and the existing local save fallback, but route the
browser high-score table through the same-origin service when it is available.
The WASM storage bridge now accepts fetched score JSON and queues one validated
submission at a time. The JavaScript plugin fetches the canonical table,
submits accepted name-entry scores, ignores stale responses, retries failures,
and feeds successful responses back into the running game.

Update the web and project documentation to describe the optional shared
leaderboard and regenerate the tracked browser artifact. A missing service
continues to leave the local table usable; the service documentation records
that anonymous client scores are intentionally not tamper-resistant.

Test Plan:
- `just test` -- passed (3 service tests and 137 game tests)
- `just clippy` -- passed
- `just web-build` -- passed
- `cargo +nightly fmt -- --check` -- passed
- `node --check web/storage.js` and `prettier --check web/storage.js` -- passed
- `rumdl check --flavor commonmark CHANGELOG.md README.md web/README.md highscore-server/README.md` -- passed
- Browser WASM load through same-origin API proxy -- passed
- `git diff --cached --check` -- passed

tdkpin-rs/web/storage.js

@@ -4,7 +4,12 @@
   const storageKey = "tdkpin.save.v1";
   const encoder = new TextEncoder();
   const decoder = new TextDecoder();
+  const highScoreApi = "/api/highscores";
   let lastRevision = 0;
+  let lastHighScoreRevision = 0;
+  let highScoreRequestInFlight = false;
+  let highScoreGeneration = 0;
+  let highScoreSubmissionWarningShown = false;
 
   function browserStorage() {
     try {
@@ -54,10 +59,81 @@
     lastRevision = revision;
   }
 
+  function deliverHighScores(json) {
+    wasm_exports.tdkpin_browser_high_scores_clear();
+    for (const byte of encoder.encode(json)) {
+      wasm_exports.tdkpin_browser_high_scores_push(byte);
+    }
+    wasm_exports.tdkpin_browser_high_scores_finish();
+  }
+
+  async function fetchHighScores() {
+    const generation = ++highScoreGeneration;
+    try {
+      const response = await fetch(highScoreApi, {
+        cache: "no-store",
+        headers: { Accept: "application/json" },
+      });
+      if (!response.ok) {
+        throw new Error(`high-score request failed (${response.status})`);
+      }
+      const json = await response.text();
+      if (generation === highScoreGeneration) {
+        deliverHighScores(json);
+      }
+    } catch (error) {
+      console.warn("shared high scores unavailable; using local scores", error);
+    }
+  }
+
+  async function flushHighScoreSubmission() {
+    if (highScoreRequestInFlight) {
+      return;
+    }
+    const revision = wasm_exports.tdkpin_browser_high_score_revision();
+    if (revision === lastHighScoreRevision) {
+      return;
+    }
+    const bytes = new Uint8Array(
+      wasm_exports.tdkpin_browser_high_score_length(),
+    );
+    for (let index = 0; index < bytes.length; index += 1) {
+      bytes[index] = wasm_exports.tdkpin_browser_high_score_byte(index);
+    }
+
+    highScoreRequestInFlight = true;
+    try {
+      const response = await fetch(highScoreApi, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: decoder.decode(bytes),
+        keepalive: true,
+      });
+      if (!response.ok) {
+        throw new Error(`high-score submission failed (${response.status})`);
+      }
+      const json = await response.text();
+      highScoreGeneration += 1;
+      deliverHighScores(json);
+      wasm_exports.tdkpin_browser_high_score_ack(revision);
+      lastHighScoreRevision = revision;
+      highScoreSubmissionWarningShown = false;
+    } catch (error) {
+      if (!highScoreSubmissionWarningShown) {
+        console.warn("shared high-score submission failed; will retry", error);
+        highScoreSubmissionWarningShown = true;
+      }
+    } finally {
+      highScoreRequestInFlight = false;
+    }
+  }
+
   function onInit() {
     sendSavedDataToRust();
     lastRevision = wasm_exports.tdkpin_browser_storage_save_revision();
+    void fetchHighScores();
     window.setInterval(flushRustSave, 50);
+    window.setInterval(() => void flushHighScoreSubmission(), 50);
     window.addEventListener("beforeunload", flushRustSave);
   }