Add DEBUG-gated panel to buy any card in the shop

When the server's DEBUG env var is on, expose a card catalog endpoint
and a collapsible client panel that drops any pet or food straight into
your deck (free, off-turn). Gated server-side so it is inert in normal
play.

internal/server/ws.go

@@ -27,6 +27,7 @@ type clientMessage struct {
 	Cards []string `json:"cards"` // discard, trade
 	Pick  int      `json:"pick"`  // tradeChoose
 	Order []string `json:"order"` // arrange
+	Name  string   `json:"name"`  // debugAdd
 }
 
 type serverMessage struct {
@@ -133,6 +134,12 @@ func (s *Server) apply(r *room, c *client, msg clientMessage) {
 		err = g.SubmitOrder(c.playerID, msg.Order)
 	case "ready":
 		err = g.AcknowledgeBattle(c.playerID)
+	case "debugAdd":
+		if !s.debug {
+			err = game.ErrInvalidAction
+		} else {
+			err = g.DebugGrant(c.playerID, msg.Name)
+		}
 	default:
 		err = game.ErrInvalidAction
 	}
@@ -149,6 +156,7 @@ func (s *Server) apply(r *room, c *client, msg clientMessage) {
 func (r *room) broadcastLocked() {
 	for c := range r.conns {
 		view := r.game.ViewFor(c.playerID)
+		view.Debug = r.debug
 		data, err := json.Marshal(serverMessage{Type: "state", State: &view})
 		if err != nil {
 			slog.Error("failed to marshal view", "err", err)