Add DEBUG-gated panel to buy any card in the shop

When the server's DEBUG env var is on, expose a card catalog endpoint
and a collapsible client panel that drops any pet or food straight into
your deck (free, off-turn). Gated server-side so it is inert in normal
play.

internal/game/game_test.go

@@ -482,3 +482,33 @@ func TestViewHidesSecrets(t *testing.T) {
 		t.Fatal("trade options must be visible to the trader")
 	}
 }
+
+func TestDebugGrant(t *testing.T) {
+	g, p1, _ := testGame(t)
+	before := len(p1.Deck)
+	if err := g.DebugGrant(p1.ID, "Ant"); err != nil {
+		t.Fatal(err)
+	}
+	if len(p1.Deck) != before+1 || p1.Deck[before].Name != "Ant" || !p1.Deck[before].IsPet() {
+		t.Fatalf("granted card should be an Ant appended to the deck: %+v", p1.Deck)
+	}
+	if p1.Deck[before].ID == "" {
+		t.Fatal("granted card should get a real instance ID")
+	}
+	// Unknown card name is rejected.
+	if err := g.DebugGrant(p1.ID, "Nonexistent"); err == nil {
+		t.Fatal("unknown card name should error")
+	}
+	// Foods can be granted too.
+	if err := g.DebugGrant(p1.ID, "Honey"); err != nil {
+		t.Fatal(err)
+	}
+	if !Catalog()[0].IsPet() { // sanity on the shared catalog helper
+		t.Fatal("catalog should start with a pet")
+	}
+	// Not allowed outside shop/cleanup.
+	g.Phase = PhaseBattle
+	if err := g.DebugGrant(p1.ID, "Ant"); err == nil {
+		t.Fatal("grant should be rejected outside the shop")
+	}
+}