Add DEBUG-gated panel to buy any card in the shop

When the server's DEBUG env var is on, expose a card catalog endpoint
and a collapsible client panel that drops any pet or food straight into
your deck (free, off-turn). Gated server-side so it is inert in normal
play.

internal/server/zz_e2e_test.go

@@ -49,7 +49,7 @@ func TestE2EBattleAckReturnsToShop(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer st.Close()
-	srv := New(st, "")
+	srv := New(st, "", false)
 	ts := httptest.NewServer(srv.Handler())
 	defer ts.Close()
 	base := ts.URL