Enforce invisibility online-only and redact laser paths for concealed opponents

[bashmohandes]

Motivation

• Prevent local activation of the online-only invisibility power-up and make the inventory UI reflect the rule.
• Ensure that laser trajectories (which resolve synchronously) do not reveal concealed opponents by leaking path data in per-viewer snapshots or impact history.

Description

• Marked the invisibility entry in POWER_UP_CATALOG with an onlineOnly flag in battle-tanks/scripts/game.js.
• Updated the client syncInventory UI in battle-tanks/scripts/app.js to render online-only pickups as disabled and labeled, and added a defensive guard in usePowerUp to block local activation.
• Redacted owner-visible laser history in server snapshots returned by stateFor in server/battle-tanks-rooms.js by clearing laserPath and removing path from impacts and lastImpact for a concealed opponent.
• Added regression tests: a UI/local-activation test in tests/battle-tanks-page.test.js and a server-side laser-redaction test in tests/battle-tanks-rooms.test.js that assert owner-visible vs viewer-redacted laser fields.

Testing

• Ran npm run check and it completed successfully with no errors.
• Ran the full suite with npm test and all tests passed (no failures).
• Ran the focused pattern npm test -- --test-name-pattern='Battle Tanks|viewer-aware|laser path|power-up' and the matching tests passed (no failures).

---

Codex Task