feat: UNO-style table, social hub, cosmetics, speed mode, store IAB

Game table & play
- UNO-style restyle: suit-aware bolder cards (+xl size), pulsing playable glow,
  big "YOUR TURN" pill, active-seat ring, trick-win particle burst, round
  confetti, match coin-rain.
- Per-league turn time via turnMsForStake: 15s starter/AI, 10s pro, 7s expert;
  mirrored server-side in GameRoom.TurnMs.
- Speed (Blitz) mode for vs-AI/private: 5s turns, race to 5, ~halved pacing.
- Matchmaking waits ~15s (randomized 12-18s) then fills bots; elapsed timer + hint.

Rewards / gifts
- Richer post-match modal (floating coins, XP bar), celebration overlay reveals
  the unlocked sticker pack, boosted daily rewards (client+server synced),
  themed 7-day daily with special day-7.

Social
- Public profile modal (identity, stats, achievement board) from leaderboard /
  friends / discover / end-of-game roster; rate-limited add-friend (10/hour).
- Social hub: Friends / Discover (player search + suggestions) / Messages inbox.
- Profile gender (shown in finder/profile) + social links with public/friends/
  hidden visibility, enforced server-side.

Cosmetics
- Distinct card backs: per-design pattern families (stripes/argyle/grid/dots/
  rays/scales/crosshatch/royal/filigree/gem) + luxury motifs (lib/cardBack.ts),
  consistent on table/shop/profile; +Peacock/Rose-Gold backs.
- Purchasable titles (shop Titles section); title shown under the seat on the
  table and in discover/public profile.
- 10 new sticker packs (banter/kol-kol, Persian trends, court cards, moods).
- Persistent level+XP bar on Home and every inner screen.

Payments
- Buy-coins gateway opens in a new tab (no SPA dead-end) + focus refresh.
- Store IAB scaffolding: Cafe Bazaar deep-link purchase + redirect-token capture,
  Myket native-bridge contract, server-side IabService.Verify for both stores,
  config-driven via Iab__* env. POST /api/coins/iab/verify (JWT).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/lib/online/signalr-service.ts

@@ -20,6 +20,8 @@ import {
   Friend,
   FriendRequest,
   LeaderboardEntry,
+  PlayerSummary,
+  PublicProfile,
   MatchSummary,
   MatchmakingState,
   RewardResult,
@@ -359,6 +361,19 @@ export class SignalrService implements OnlineService {
     return this.send<{ ok: boolean; messageFa: string; messageEn: string }>(
       "POST", "/api/friends/add", { query: q });
   }
+  addFriendById(userId: string) {
+    return this.send<{ ok: boolean; messageFa: string; messageEn: string }>(
+      "POST", "/api/friends/add", { userId });
+  }
+  getPublicProfile(userId: string): Promise<PublicProfile> {
+    return this.getJson<PublicProfile>(`/api/profile/${encodeURIComponent(userId)}/public`);
+  }
+  searchPlayers(query: string): Promise<PlayerSummary[]> {
+    return this.getJson<PlayerSummary[]>(`/api/players/search?q=${encodeURIComponent(query)}`);
+  }
+  suggestedPlayers(): Promise<PlayerSummary[]> {
+    return this.getJson<PlayerSummary[]>("/api/players/suggested");
+  }
   async acceptRequest(id: string) { await this.send<unknown>("POST", "/api/friends/accept", { id }); }
   async declineRequest(id: string) { await this.send<unknown>("POST", "/api/friends/decline", { id }); }
   async removeFriend(id: string) { await this.send<unknown>("POST", "/api/friends/remove", { id }); }
@@ -436,4 +451,14 @@ export class SignalrService implements OnlineService {
       "POST", "/api/coins/pay/request", { packId: id });
     return { ok: r.ok, coins: 0, redirectUrl: r.url };
   }
+  async verifyIab(store: string, productId: string, token: string) {
+    try {
+      const r = await this.send<{ ok: boolean; profile?: UserProfile; coins: number }>(
+        "POST", "/api/coins/iab/verify", { store, productId, token });
+      if (r.profile) this.cachedProfile = r.profile;
+      return { ok: r.ok, profile: r.profile, coins: r.coins ?? 0 };
+    } catch {
+      return { ok: false, coins: 0 };
+    }
+  }
 }