Merge feature/add_skin into master: resolve all conflicts

- GameGlobal.js: keep upstream SERVER_URL with /ws suffix
- en.js/zh.js: merge both settings.nickname and settings.profile keys
- SettingsScene.js: keep both nickname row and profile button
- server/index.js: merge express app + content security proxy with
  noServer WebSocket mode and path validation
- Add .gitignore for node_modules and .codebuddy

deploy/content-security/configmap.yaml

@@ -0,0 +1,25 @@
+# ============================================================
+# ConfigMap: content-security-config
+# Centralized configuration for content security service.
+# WX_APPID and WX_APPSECRET should be overridden via SealedSecret
+# or external secret management in production.
+# ============================================================
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: content-security-config
+  namespace: content-security
+  labels:
+    app: content-security-service
+data:
+  NODE_ENV: "production"
+  HOST: "0.0.0.0"
+  PORT: "3000"
+  # Default game_id for requests without explicit game_id
+  DEFAULT_GAME_ID: "tankwar"
+  # Audit log retention in days
+  AUDIT_LOG_RETENTION_DAYS: "180"
+  # Rate limit: max requests per minute to WeChat API
+  RATE_LIMIT_PER_MINUTE: "5000"
+  # API timeout in milliseconds
+  API_TIMEOUT_MS: "3000"