Merge feature/add_skin into master: resolve all conflicts

- GameGlobal.js: keep upstream SERVER_URL with /ws suffix
- en.js/zh.js: merge both settings.nickname and settings.profile keys
- SettingsScene.js: keep both nickname row and profile button
- server/index.js: merge express app + content security proxy with
  noServer WebSocket mode and path validation
- Add .gitignore for node_modules and .codebuddy

game.js

@@ -27,6 +27,7 @@ const ShareManager = require('./js/managers/ShareManager');
 const CurrencyManager = require('./js/managers/CurrencyManager');
 const PaymentManager = require('./js/managers/PaymentManager');
 const ComplianceManager = require('./js/managers/ComplianceManager');
+const ContentSecurityManager = require('./js/managers/ContentSecurityManager');
 const BuffManager = require('./js/managers/BuffManager');
 const SkinManager = require('./js/managers/SkinManager');
 const PlayerProfile = require('./js/managers/PlayerProfile');
@@ -76,6 +77,7 @@ const shareManager = new ShareManager();
 const currencyManager = new CurrencyManager();
 const paymentManager = new PaymentManager();
 const complianceManager = new ComplianceManager();
+const contentSecurityManager = new ContentSecurityManager();
 const buffManager = new BuffManager();
 const skinManager = new SkinManager();
 const playerProfile = new PlayerProfile();
@@ -84,6 +86,7 @@ GameGlobal.shareManager = shareManager;
 GameGlobal.currencyManager = currencyManager;
 GameGlobal.paymentManager = paymentManager;
 GameGlobal.complianceManager = complianceManager;
+GameGlobal.contentSecurityManager = contentSecurityManager;
 GameGlobal.buffManager = buffManager;
 GameGlobal.skinManager = skinManager;
 GameGlobal.playerProfile = playerProfile;
@@ -271,6 +274,14 @@ const LoadingScene = {
     // Initialize audio system (programmatic synthesis, no files needed)
     audioManager.init();
 
+    // Initialize content security manager (local word list + remote sync)
+    // Derive HTTP base URL from WebSocket server URL for content security API calls
+    const wsUrl = networkManager._serverUrl || '';
+    const httpServerUrl = wsUrl.replace(/^wss?/, 'https');
+    contentSecurityManager.init({
+      serverUrl: httpServerUrl,
+    });
+
     // Define all image assets to preload
     // For now we use procedural drawing, so asset list is empty.
     // Assets can be added later as the game grows.