feat: harden prototype combat hit validation

[JOY (JOY)]

Summary

• harden the prototype combat training hit RPC with structured unknown-target, blocked, outside-cone, out-of-range, invalid-validation, and rebuilding miss responses
• return a server-generated combat_event_id for each validated hit and audit the finishing hit before the BodyTime reward row
• expose combat_event_id to Unity DTO/logging and update architecture, roadmap, changelog, and gameplay ledger TDD notes

Verification

• npm.cmd ci
• npm.cmd run build
• npm.cmd test
• npx.cmd markdownlint-cli2@0.15.0 CHANGELOG.md ROADMAP.md docs/ARCHITECTURE.md docs/design/23-gameplay-ledger-technical-design.md
• rg -n "—|–" CHANGELOG.md ROADMAP.md docs/ARCHITECTURE.md docs/design/23-gameplay-ledger-technical-design.md backend/nakama/modules/index.ts backend/nakama/tests/supabase_custom_auth.test.mjs Unity/Assets/_SecondSpawn/Scripts/AI/AgentContextDto.cs Unity/Assets/_SecondSpawn/Scripts/AI/CharacterMemorySync.cs (no matches)
• git diff --check
• local code-review fallback: APPROVED, no authority, package, provider-key, or client-mutated combat state violations found

Notes

Unity root Play Mode smoke will be run after merge into dev because the active Unity Editor is opened on the root project, while this change is isolated in a feature worktree.

Closes #147