Add DEBUG-gated panel to buy any card in the shop

When the server's DEBUG env var is on, expose a card catalog endpoint
and a collapsible client panel that drops any pet or food straight into
your deck (free, off-turn). Gated server-side so it is inert in normal
play.

internal/game/game.go

@@ -430,6 +430,25 @@ func (g *Game) TradeChoose(playerID string, pick int) error {
 	return nil
 }
 
+// DebugGrant drops any card straight into a player's deck during the shop,
+// free and off-turn — a testing aid gated behind the server's DEBUG flag, not
+// a normal action. No buy effects fire.
+func (g *Game) DebugGrant(playerID, name string) error {
+	if g.Phase != PhaseShop && g.Phase != PhaseCleanup {
+		return ErrWrongPhase
+	}
+	p := g.PlayerByID(playerID)
+	if p == nil {
+		return errors.New("unknown player")
+	}
+	c, ok := g.cardByName(name)
+	if !ok {
+		return fmt.Errorf("%w: no card named %q", ErrInvalidAction, name)
+	}
+	p.Deck = append(p.Deck, c)
+	return nil
+}
+
 // Pass forfeits the player's remaining coins and ends their shopping.
 func (g *Game) Pass(playerID string) error {
 	p, err := g.requireShopTurn(playerID)