Comic toon look + leaderboard scope fix

[dev0zzz]

Summary

• Comic toon look: every lit MeshStandardMaterial becomes a MeshToonMaterial at build time (toonifyScene, banded gradient map). A ComicOutlinePass draws ink lines from depth/normal edges; the grade pass lifts exposure, pulls neutral mids toward Tessera gold (saturated signal colors like the red finish stay untouched), adds manga speed lines above ~55% of MAX_SPEED and a soft vignette. Solid track plates are brighter so gaps read as black holes with ink edges. The hazard codex previews run through the same pipeline.
• Leaderboard scope fix: dev loopback OAuth clients only got the bare atproto scope, so score writes failed with Missing required scope repo:at.tessera.skytess.score. The SDK now carries the scope in the loopback client_id; prod client-metadata.json requests the same granular scope. Existing sessions need one re-login.
• SDK migration: consumes @dev0zzz.tessera.at/sdk@0.10.3 from registry.tessera.at (scope-per-handle, Ed25519-signed publish) instead of @tesseraat/sdk from npmjs.

Test plan

• 264 unit tests green, tsc + vite build clean
• Verified in-browser: toon shading, outlines, gap readability, codex previews, speed lines
• OAuth authorize request carries atproto repo:at.tessera.skytess.score
• Re-login once, finish a run, confirm the score lands on the leaderboard

🤖 Generated with Claude Code

https://claude.ai/code/session_01AkRn3wzWCmsTrQufGWaRH7

[dev0zzz]

Adversarial self-review (2 parallel reviewers: render pipeline & material lifecycle, OAuth scope & registry migration) — all confirmed findings fixed in d155052:

• Critical: Dockerfile didn't copy .npmrc before pnpm install → the Coolify/Docker build 404'd on @dev0zzz.tessera.at/sdk (reproduced via actual image build). Fixed.
• Critical: toonifyScene dropped blending/depthWrite when cloning materials → the ghost ship's additive hologram look silently reverted to muddy normal blending with wrong occlusion. Fixed and visually verified.
• Minor: removed a dead @tesseraat/sdk: link: override from pnpm-workspace.yaml; added a guard test asserting client-metadata.json scope == auth.ts OAUTH_SCOPE; codex preview now drives the grade pass uniforms.

Conscious waiver: SceneRenderer.time accumulates unbounded; after many hours of continuous attract-mode the speed-line hash may degrade cosmetically (sin() precision). Not fixed — cosmetic, slow onset, no crash path.

Scope logic itself was verified end-to-end against @atproto/pds source: repo:at.tessera.skytess.score without action qualifier covers create+update+delete, so putRecord is fully covered; listRecords/describeRepo are unauthenticated reads.