Fix critical security, stability, and performance quick wins

[Sparksx]

Summary

Comprehensive codebase audit across security, stability, performance, and functionality — this PR implements the highest-priority quick wins (high impact, low difficulty).

Security

• Refund webhook silent failure — charge.refunded webhook now returns 500 on DB error instead of 200, so Stripe retries instead of assuming success (prevents gold leakage)
• Open redirect via Stripe URLs — success/cancel URLs validated against allowed origins whitelist instead of trusting raw Origin/Referer headers

Stability

• Save loss on tab close — beforeunload flush now uses navigator.sendBeacon() for guaranteed delivery (+ new /api/game/state/beacon endpoint)
• Clan leave race condition — ownership transfer + member delete wrapped in a single interactive transaction
• Mission progress double-completion — progress check re-reads current value inside transaction to prevent concurrent completeMission() calls
• Expedition resolution crash — per-expedition try/catch so one failed resolution doesn't crash the entire handler
• Chat history hang — emits error response on DB failure instead of leaving client waiting forever
• Negative expedition rewards — clamp xpGain/goldPot to Math.max(0, ...)

Performance

• HTTP compression — added compression middleware for gzip responses on all API payloads
• Mission contribution over-fetch — contributions query limited to take: 3 + orderBy: desc at DB level (was fetching all, sorting in JS, slicing to 3)
• Missing indexes — ChatMessage.senderId and User.createdAt for admin/moderation queries

Quality

• Forge probability validation — new test suite verifying all 35 FORGE_LEVELS rows sum to 100%, have 7 slots, and no negative values

Test plan

• npm test — 311 tests pass (including 3 new forge validation tests)
• npm run lint — 0 errors (only pre-existing warnings)
• npm run build — production build succeeds
• Verify sendBeacon save works on tab close (manual browser test)
• Verify Stripe checkout redirects to correct origin in prod
• Verify clan leave as owner correctly transfers/disbands

🤖 Generated with Claude Code

https://claude.ai/code/session_01LecvFszB9cnNJfRBMpX2ia

---

Generated by Claude Code