hmp-ui sliders and live input, hmp-houses client shim, optional gamemodes pack

[Kheartz]

Why

Groundwork for shipping complete games on Foundations, starting with Quidditch in a follow-up PR. That needs three things the stack doesn't have yet: sliders that apply live while you drag them (for tuning screens), a way for a client-bearing resource to depend on hmp-houses, and somewhere optional for gamemodes to live so not every server has to load them.

Change

hmp-ui: range fields and live input changes

• Input dialogs gain a range field: a slider with its value beside it, bounded by min and max, with an optional step (now honoured by number fields too) and a short unit label.
• input(player, dialog, { onChange }) reports number, range, checkbox and select edits while the dialog is still open. A dragged slider reports at most every 100 ms, and its final value is always sent. Text fields still report only on submit.
• Every live value is validated on the server against the exact field it claims to be, from that dialog's own player only, with a per-field rate limit. The dialog still resolves with the full result on submit, or null on cancel, which is where a tuning screen puts its original values back.
• Client-side (local) dialogs get the same onChange, validated on the client.

hmp-houses: client dependency shim

The Framework applies one dependency graph to server and client, and release:check refuses a client-bearing resource that depends on a server-only one. Like hmp-mysql, hmp-houses now ships an empty client entry so such resources can depend on it.

Gamemodes: an optional pack

• Complete games go in gamemodes/resources/hmp-<name>, as workspaces like any core resource. gamemodes/README.md covers what they are, how to install one, and how to add one.
• They release with the core pack on its version, as a separate archive, hmp-gamemodes-v<version>.zip, with a gamemodes.json naming the Foundations version it needs. The container image stays core-only.
• release:check covers both roots: same version, dependencies and priorities, the client-dependency rule, the lockfile and the Dockerfile. A core resource depending on a gamemode is an error, so the core pack always stands alone.
• With no gamemodes yet (this PR adds none), no gamemodes pack is built, and CI and the release workflow skip it.
• README, INSTALL (a new "Optional gamemodes" step, plus the upgrade note), COMPATIBILITY and CHANGELOG are updated.

Testing

• New hmp-ui tests: range field normalisation; live changes validated per field (step, bounds, options, text excluded, rate limit, wrong player, settled dialog); and the client forwarding remote edits while validating local ones. The bundle smoke test checks the new handlers and the slider markup.
• The slider and live reporting checked in the page's own ?dev=input preview: rendering, throttled drags with the final value sent, checkbox and select changes, and the submitted values.
• npm run verify passes: all 28 resources' tests, typecheck, build, smoke and package, with release:check reporting 28 resources and 0 gamemodes. npm ci accepts the updated lockfile.