Add safe AI opponent provider layer

[YfengJ]

Summary

• add a validated AI opponent decision layer with legal-action checks and heuristic fallback
• support cloud proxy, local OpenAI-compatible, and MCP tool providers without exposing production API keys in the frontend
• add provider controls, connection testing, anti-farm metadata, docs, and a server-side proxy example

Closes #17

Validation

• node --test demo/human-vs-bots/ai-opponent.test.mjs scripts/ai-opponent-proxy.test.mjs godot/web/stellar_bridge.test.js
• node --check demo/human-vs-bots/ai-opponent.js && node --check demo/human-vs-bots/game.js && node --check scripts/ai-opponent-proxy.mjs && node --check godot/web/stellar_bridge.js
• git diff --check
• Playwright smoke: opened demo, connected wallet, started a match, ended one turn through the async AI controller; only favicon.ico 404 appeared in console

Security notes

• Cloud provider keys stay in the proxy process environment.
• The browser sends only compact game state and legal actions to the configured provider.
• Invalid model output, unavailable providers, and illegal actions fall back to the existing heuristic bot.

[YfengJ]

CI note: SonarCloud passed. The red check is the existing Godot Web export path failing before app code is exercised, with:\n\nCannot export project with preset "Web" due to configuration errors\n\nLocal validation for this PR passed:\n- node --test demo/human-vs-bots/ai-opponent.test.mjs scripts/ai-opponent-proxy.test.mjs godot/web/stellar_bridge.test.js\n- node --check demo/human-vs-bots/ai-opponent.js && node --check demo/human-vs-bots/game.js && node --check scripts/ai-opponent-proxy.mjs && node --check godot/web/stellar_bridge.js\n- git diff --check\n- Browser smoke: connected wallet, started a match, and ended one turn through the async AI controller.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud