Update 5.9.24: reward security, iOS stability and responsive polish

A release with no loud new features, but an important one: we closed reward farming, fixed a couple of crashes and cleaned up the UI across all screens.

REWARD SECURITY

Previously it was theoretically possible to farm in-game currency and progress. We closed three vectors: AI difficulty is now locked by a signed token before the game starts (you can't claim "I won on hard" after the fact); rewarded ads are verified server-side via Google SSV; daily-mission progress is granted only by the server and only from verified actions. Difficulty spoofing and reward farming are closed.

We also updated the ws networking package to 8.21.0 (DoS + memory-leak fixes) and ran a full dependency audit — 0 known vulnerabilities. Added SECURITY.md and an audit document.

CRASHES AND BUILDS

iOS: fixed a crash on launch. Ad init triggered the App Tracking Transparency prompt without the required Info.plist key — the system killed the app. iOS ads now initialize only when AdMob is actually configured.

Android: restored the release build — a missing release {} block in build.gradle broke R8 minification. Signed AAB and APK build again.

SCREENS

The game result panel in landscape on phones no longer clips the "Play again" and "Rematch" buttons — we added scroll and safe-area padding (notch / home indicator). Toasts (day streak, achievements, cookie banner) no longer slip under the notch / Dynamic Island or the home indicator.

Accessibility: 9 modal dialogs got proper screen-reader semantics (role="dialog", aria-modal, labels), icon buttons are labeled, decorative icons are hidden from narration. Touch targets bumped to 44px per Apple and Google guidelines.

STABILITY

In CI we added a blocking test-coverage gate and a blocking typecheck, and wrote +28 new unit tests (806 passing). Dependency installs are now reproducible (npm ci).