feat: major redesign — ELO system, 4 practice modes, history view, mobile nav

- 4 practice modes: Timed (SVG ring), Endless (3 lives), Category Drill, Speed Run
- Practice settings modal (timer duration, difficulty) with localStorage persistence
- History view: paginated table, SVG score chart, best-times-per-stratagem
- ELO rating system with server-side K=32 calculation and rank tiers PRIVATE–GENERAL
- Post-match result modal with ELO delta and round history
- Challenge modal showing challenger name + ELO (replaces toast)
- Dashboard hero card with ELO rank icon and daily sequence preview
- Leaderboard tabs: Practice Score / ELO / Speed Run
- Mobile hamburger nav drawer with slide-in animation
- DB migration: elo column, mode column, stratagem_stats table
- WS lobby-update now sends {name, elo, rank} objects
- View fade transitions, danger vignette at ≤5s, streak fire glow, combo badge
- Esc/Enter keyboard shortcuts for modals and practice

public/app.js

@@ -795,5 +795,24 @@ function showToast(msg) {
   }, 3200);
 }
 
+// ── Static button bindings (replaces inline onclick – blocked by CSP script-src-attr) ──
+document.getElementById('btn-logout')          ?.addEventListener('click', logout);
+document.getElementById('btn-daily-challenge') ?.addEventListener('click', startDailyChallenge);
+document.getElementById('btn-start-practice')  ?.addEventListener('click', startPractice);
+document.getElementById('btn-stop-practice')   ?.addEventListener('click', stopPracticeUI);
+document.getElementById('match-ready-btn')     ?.addEventListener('click', setReady);
+document.getElementById('btn-leave-match')     ?.addEventListener('click', leaveMatch);
+document.getElementById('btn-create-user')     ?.addEventListener('click', createUser);
+
+// D-pad: practice and match both use data-dir buttons
+document.getElementById('practice-dpad')?.addEventListener('click', (e) => {
+  const dir = e.target.closest('[data-dir]')?.dataset.dir;
+  if (dir) dpadInput(dir);
+});
+document.getElementById('match-dpad')?.addEventListener('click', (e) => {
+  const dir = e.target.closest('[data-dir]')?.dataset.dir;
+  if (dir) dpadInput(dir);
+});
+
 // ── Init ──────────────────────────────────────────────────────────────────────
 document.addEventListener('DOMContentLoaded', checkAuth);