Merge feature/add_skin into master: resolve all conflicts

- GameGlobal.js: keep upstream SERVER_URL with /ws suffix
- en.js/zh.js: merge both settings.nickname and settings.profile keys
- SettingsScene.js: keep both nickname row and profile button
- server/index.js: merge express app + content security proxy with
  noServer WebSocket mode and path validation
- Add .gitignore for node_modules and .codebuddy

deploy/content-security/secret.yaml

@@ -0,0 +1,19 @@
+# ============================================================
+# Secret: content-security-secrets
+# WeChat Mini Program credentials for content security APIs.
+# IMPORTANT: In production, use SealedSecret or external secret
+# management (e.g., HashiCorp Vault) instead of plain Secrets.
+# ============================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: content-security-secrets
+  namespace: content-security
+  labels:
+    app: content-security-service
+type: Opaque
+stringData:
+  # WeChat Mini Program App ID (replace with actual value)
+  WX_APPID: "wx3527fe2fd49db523"
+  # WeChat Mini Program App Secret (replace with actual value)
+  WX_APPSECRET: "a8e92749ccf2f4bc2667833812a7bf4e"