feat: complete Phase 4 combat/hunting system

- Add content migration (003_content.sql): zones, monsters, items, loot tables
- Add inventory migration (004_inventory.sql) and logs migration (006_logs.sql)
- Add Mulberry32 PRNG (src/utils/rng.js) for deterministic combat
- Add combat system (src/game/combat.js) with turn order, crit, mage bonus, 20-round cap
- Add rewards/loot system (src/game/rewards.js) and leveling (src/game/leveling.js)
- Add hunt endpoint (POST /api/hunt) with full combat flow in DB transaction
- Add hunt integration tests and unit tests for rewards/leveling/combat
- Fix session middleware to use memory store in tests (avoids cleanup hang)
- Fix huntService transaction (db.transaction() returns wrapper, must call separately)
- Add huntService to helpers.js cache invalidation for test isolation

src/app.js

@@ -3,6 +3,7 @@ const helmet = require('helmet');
 const { createSessionMiddleware, requireAuth } = require('./middleware/session');
 const { registerLimiter, loginLimiter, routes: authRoutes } = require('./routes/auth');
 const { routes: characterRoutes } = require('./routes/character');
+const { routes: huntRoutes } = require('./routes/hunt');
 const { AppError } = require('./utils/errors');
 
 function createApp() {
@@ -40,6 +41,9 @@ function createApp() {
   app.post('/api/character', requireAuth, characterRoutes.postCharacter);
   app.get('/api/character', requireAuth, characterRoutes.getCharacter);
 
+  // Hunt routes (require session)
+  app.post('/api/hunt', requireAuth, huntRoutes.postHunt);
+
   // Central error handler
   app.use((err, _req, res, _next) => {
     // Log stack traces server-side only