Merge feature/add_skin into master: resolve all conflicts

- GameGlobal.js: keep upstream SERVER_URL with /ws suffix
- en.js/zh.js: merge both settings.nickname and settings.profile keys
- SettingsScene.js: keep both nickname row and profile button
- server/index.js: merge express app + content security proxy with
  noServer WebSocket mode and path validation
- Add .gitignore for node_modules and .codebuddy

deploy/content-security/service.yaml

@@ -0,0 +1,43 @@
+# ============================================================
+# Service: content-security-service
+# ClusterIP service for internal access from game namespaces.
+# ============================================================
+apiVersion: v1
+kind: Service
+metadata:
+  name: content-security-service
+  namespace: content-security
+  labels:
+    app: content-security-service
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 3000
+      protocol: TCP
+      targetPort: 3000
+  selector:
+    app: content-security-service
+---
+# ============================================================
+# Service: content-security-nodeport
+# NodePort service for external access (development/debug only).
+# Should be removed or restricted in production.
+# ============================================================
+apiVersion: v1
+kind: Service
+metadata:
+  name: content-security-nodeport
+  namespace: content-security
+  labels:
+    app: content-security-service
+spec:
+  type: NodePort
+  ports:
+    - name: http
+      port: 3000
+      protocol: TCP
+      targetPort: 3000
+      nodePort: 30082
+  selector:
+    app: content-security-service