Add DEBUG-gated panel to buy any card in the shop

When the server's DEBUG env var is on, expose a card catalog endpoint
and a collapsible client panel that drops any pet or food straight into
your deck (free, off-turn). Gated server-side so it is inert in normal
play.

web/src/api.ts

@@ -1,4 +1,4 @@
-import type { Session } from './types'
+import type { Card, Session } from './types'
 
 const SESSION_KEY = 'sapbg-session'
 
@@ -21,6 +21,12 @@ export function joinGame(code: string, name: string): Promise<Session> {
   return post('/api/join', { code, name })
 }
 
+export async function fetchCatalog(): Promise<Card[]> {
+  const res = await fetch('/api/catalog')
+  if (!res.ok) throw new Error('failed to load catalog')
+  return (await res.json()) as Card[]
+}
+
 export function loadSession(): Session | null {
   try {
     const raw = localStorage.getItem(SESSION_KEY)