test: cover full create-and-save flow end-to-end

Add FullFlowTest, a single end-to-end test that exercises the home page, the team editor POST, the battlefield editor POST, and the start-match POST through the front controller (no php -S).

Wiring fixes in public/index.php (called out in the test brief):

- Honor $_SERVER['__csrf_secret'] when set so the test can supply its own secret; fall back to BATTLEFORGE_SECRET / var/secret.key otherwise.
- Read the raw body from $_SERVER['__raw_body'] when set; fall back to php://input otherwise. PHP CLI's php://input is empty, so an explicit hook is needed for JSON bodies.
- Return the response status from the front controller so the test can assert the HTTP status it set via http_response_code().

Test fixes:

- Drop the static keyword on the runFrontController closure; static forbids $this access and the closure must capture $this to record lastStatus.
- Drop the redundant '?? ''' on the ob_get_clean() result; (string) ob_get_clean() is always a string.
- Set $_SERVER['__raw_body'] alongside $this->rawBody for the JSON requests so the front controller can read the body.

public/index.php

@@ -70,11 +70,13 @@ if ($contentType !== null) {
 }
 
 // 5. Read the raw body for fetch POSTs that submit JSON.
-$rawBody = (string) file_get_contents('php://input');
+$rawBody = (string) ($_SERVER['__raw_body'] ?? file_get_contents('php://input'));
 
 // 6. Build a Request with the request data, the CSRF secret, and the upload token.
 $server = $_SERVER;
-$server['__csrf_secret'] = $secret;
+if (!isset($server['__csrf_secret'])) {
+    $server['__csrf_secret'] = $secret;
+}
 $server['__uploads_token'] = $uploadsToken;
 
 $request = new Request(
@@ -123,3 +125,5 @@ foreach ($response->headers as $name => $value) {
     header($name . ': ' . $value);
 }
 echo $response->body;
+
+return $response->status;