Add world roll API and seed telemetry client

/api/roll deals deterministic challenger rolls server-side (same salts and
sha256 ranking as the local seed, verified bit-for-bit); the request log is
the impression record. /api/chosen takes the anonymous choice ping. Events
land in Workers Analytics Engine.

concept-seed.mjs resolves data in order: local catalog dir, roll API,
degraded promotion-only seed. --chosen sends the choice ping; DO_NOT_TRACK
and IMPECCABLE_NO_TELEMETRY disable it. API-dealt seeds carry the telemetry
instruction inline.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/build.js

@@ -646,7 +646,7 @@ function generateCFConfig(buildDir) {
   // Without this, the SPA fallback serves index.html for function routes
   const routes = {
     version: 1,
-    include: ['/api/download/*', '/worlds/cards/*'],
+    include: ['/api/download/*', '/api/roll', '/api/chosen', '/worlds/cards/*'],
     exclude: [],
   };
   fs.writeFileSync(path.join(buildDir, '_routes.json'), JSON.stringify(routes, null, 2));

scripts/sync-api-data.mjs

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+// Copies the catalog JSON files into functions/api/_data/ so the roll API
+// bundles the current revision at deploy. Run before `bun run deploy`
+// whenever catalog content changed (the deploy script chains it).
+
+import { copyFileSync, mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = join(ROOT, 'skill', 'scripts');
+const DEST = join(ROOT, 'functions', 'api', '_data');
+const FILES = [
+  'concept-ingredients.json',
+  'concept-reviews.json',
+  'composition-ingredients.json',
+  'composition-reviews.json',
+];
+
+mkdirSync(DEST, { recursive: true });
+for (const file of FILES) {
+  copyFileSync(join(SRC, file), join(DEST, file));
+}
+process.stdout.write(`synced ${FILES.length} catalog files -> functions/api/_data\n`);