Put the bug report behind an always-available button.

The debug report was only reachable in DEBUG mode, which is the one mode
a player hitting a real bug won't be running. Move it to a "🐛 Report a
bug" item in the game menu: a note field, a download, and a copy-as-text,
on any server.

That knowingly shows the reporter their opponents' hands and the shop
deck order. Credentials are still required, so a report only ever reaches
someone seated at that table. The buy-any-card panel stays DEBUG-only —
it changes the game; a report only reads it.

internal/server/server.go

@@ -59,15 +59,15 @@ func (s *Server) Handler() http.Handler {
 // `format=text` renders it for reading instead of as JSON, and `note=` records
 // what looked wrong.
 //
-// A report holds hidden information — the opponents' decks, the order of the
-// shop decks — so a seated player must not be able to pull one mid-game. It is
-// DEBUG-only for that reason; on a live server, `go run ./cmd/report` reads the
-// same report straight out of the database instead.
+// This backs the in-game "Report a bug" button, so it is deliberately not
+// DEBUG-gated: a reproducible bug report is worth more than the hidden
+// information a report gives away. It does hand a seated player their
+// opponents' hands and the order of the shop decks, which a determined one
+// could read mid-game — the trade accepted here is that a player who wants to
+// cheat gains little and a player who hits a bug can actually report it.
+// Credentials are still required, so a report only ever goes to someone at that
+// table.
 func (s *Server) handleDebugReport(w http.ResponseWriter, req *http.Request) {
-	if !s.debug {
-		httpError(w, http.StatusNotFound, "debug reports are only served in DEBUG mode")
-		return
-	}
 	q := req.URL.Query()
 	r, err := s.getRoom(q.Get("game"))
 	if err != nil {