v0.134.0 — Issues B1: a socket security fix, Create Map without a dialog, and more from the tracker

The first batch of the GitHub Issues program, which works through the platform's issue tracker: every open issue was triaged, the valid ones fixed, and the rest answered on the issue. The verdicts, reproductions and test script are in the batch file.

• [x] #120 — Live events reach only the campaign that sent them (security). Twelve live relays (cursors, token drags, targeting previews, map invites, initiative movement, voice transcription, and 3D dice) sent each event to whichever campaign or channel its payload named, without checking that the sender had joined it. Anyone signed in who knew a campaign's id, which appears in every map URL, could put cursors, invites or transcript lines in front of its players. Each relay now goes only to a room the sender joined, and joining still checks that they may read the campaign. A guard test fails the build if a new relay skips the check. Nothing changes for players in their own campaigns.
• [x] #73 — Bring all to this map says what it did. Pressing it showed nothing, so it looked like it did nothing. The button now shows a spinner while the invite is in flight and a check once it lands, and a notification says how many players were asked to join ("2 players were asked to join this map"), that no one else is connected, or that the invite wasn't sent because the server didn't answer. The server acknowledges focusAllPlayers with the number of people it reached (not sockets: a player with two tabs counts once). The map's context menu and the map controls' menu, which send the same invite, notify the same way.
• [x] Players stay connected to the campaign when they leave a map. Found at this release's gate: a player who went from a map to the campaign's own page dropped out of the campaign's live updates. They missed Bring all to this map invites (the GM was told no one else was connected) and other changes, until their connection happened to reset. Leaving a map no longer drops a player from their campaign; leaving the campaign does.
• [x] #113 — The nub's selects work on a phone. Touching the Campaign, Map or Layer select's list to scroll it closed the whole popover a moment later, so a phone couldn't switch maps. The lists are drawn outside the popover (so its scroll area can't clip them), and the popover counted a touch there as a touch outside. It now counts its own lists as inside; a touch anywhere else still closes it.
• [x] #70 — Campaign pages read over bright art. A campaign's Background was dimmed by one flat black layer, which still left the page hard to read over colourful art. With a Background set, the page's content now sits on its own translucent panel with the art blurred behind it: dark brown in the retro skins, a matching tint in the others (light in the light skins), and the layer over the rest of the art is lighter, so the art still shows around the panel. Pages without a Background are unchanged.
• [x] #118 — Create Map makes the map at once. No more dialog. Create Map on a campaign's page, New Map in the map nub, and the /play/<campaign>/new link each make a grass map named "Untitled Map N" (one past the highest in the campaign) and open it with Edit Map showing and the name selected, so typing replaces it. A double click makes one map; a failed create says so and stays put. (The ?left=editMap link, which Edit Map's sidebar was never reachable by, now works too.)