feat: add multiplayer typing races (@jhonsfranky17)

[jhonsfranky17]

Summary

• Real-time multiplayer racing: create a private room, share the room code/link, race the same word list live against friends, and see ranked results at the end
• Socket.IO layer attached to the existing Express server, authenticated via the existing Firebase token verification (verifyIdToken)
• Room/player state lives in Redis, fully isolated from the results/PB/XP pipeline — races never affect real stats or leaderboards
• Every player sees the identical word sequence (host generates it once, server relays it verbatim), a blurred in-game countdown overlay before the race starts, and a synchronized timer start (forced at "go" instead of each player's own first keystroke)
• New /multiplayer and /multiplayer/:roomCode pages, socket client, and Solid state module on the frontend; new packages/schemas/packages/contracts multiplayer definitions on the shared side; new Socket.IO + Redis layer on the backend

Out of scope / follow-ups

• Public matchmaking, spectator mode, rematch brackets beyond the current room reset
• Horizontal-scaling Redis pub/sub adapter for Socket.IO (fine for a single backend instance)
• Production-grade anti-cheat on live progress (matches the existing solo-test posture, where real anti-cheat is a private module not in this repo)
• Automated test coverage for the new Redis room logic and socket auth

Test plan

• tsc --noEmit and oxlint --type-aware --type-check clean across schemas, contracts, backend, and frontend
• Exercised the REST endpoints directly (create room, get room, 404/422/401 paths) against a local Mongo+Redis backend
• Exercised the socket auth layer (missing/invalid token rejection)
• Manually tested the full flow end-to-end in two browser sessions with real Firebase accounts: create room → invite link → join → ready up → synchronized countdown → race → ranked results → rematch

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	socket.io-client@​4.8.3
	socket.io@​4.8.3

View full report

[github-actions]

Continuous integration check(s) failed. Please review the failing check's logs and make the necessary changes.