feat: polish Supabase Nakama auth HUD

[JOY (JOY)]

Summary

• add a dedicated Play Mode auth HUD block with Supabase-backed, local-fallback, and no-session states
• add an auth retry button that reruns the full Supabase to Nakama custom-auth flow
• humanize common Supabase anonymous auth and Nakama custom-auth bridge failures
• extend Nakama custom-auth tests for Supabase server-error and invalid-JSON rejection paths
• update architecture, roadmap, changelog, backend README, and Play Mode smoke checklist

Verification

• npm.cmd ci
• npm.cmd run build
• npm.cmd test
• npx.cmd markdownlint-cli2@0.15.0 CHANGELOG.md ROADMAP.md docs/ARCHITECTURE.md docs/setup/play-mode-smoke-checklist.md backend/nakama/README.md
• rg -n "—|–" CHANGELOG.md ROADMAP.md docs/ARCHITECTURE.md docs/setup/play-mode-smoke-checklist.md backend/nakama/README.md backend/nakama/tests/supabase_custom_auth.test.mjs Unity/Assets/_SecondSpawn/Scripts/AI/SecondSpawnGatewayClient.cs Unity/Assets/_SecondSpawn/Scripts/UI/HUDController.cs (no matches)
• git diff --check
• local code-review fallback: APPROVED, Unity still sends only Supabase access tokens to Nakama, Nakama owns token verification, device auth remains explicit fallback, no secrets or package changes

Notes

Root Unity recompile and Play Mode smoke will be run after merge into dev because the active Unity Editor is opened on the root project.

Closes #150