Add an online mode that plays the sounds on the viewer

[obilodeau]

Closes #40.

During an online event the tab we screen-share is the viewer, but every
sound has always played on the host machine — so the audience heard nothing.
ceopardy serve --online flips that: the viewer becomes the audio sink and
the host goes quiet.

How it works

The host no longer plays sounds directly. It asks the server to broadcast a
cue on the /game namespace, and each client decides for itself whether it
is the one that should make noise:

// useSound.ts
if (window.self !== window.top) return false;  // the host's embedded viewer iframe
return game.onlineMode ? !game.isHost : game.isHost;

That iframe guard matters — the host footer drawer embeds a live viewer, so
without it online mode would make the host louder rather than silent.

A pure host→viewer Socket.IO design isn't possible here: the server
registers only connect/disconnect and Flask-SocketIO drops client-emitted
events it has no handler for. Since timeout and the waiting music had no
server round-trip at all, a channel was needed regardless, so this uses one
generic sound event behind a REST POST /api/v1/sound, matching the
documented client→server-is-REST convention.

The viewer shows a one-time "Click to enable sound" overlay, because
browsers won't play audio until the tab has seen a user gesture. It's
dismissed during screen-share setup and never returns.

Drive-by fixes

Extracting the audio layer surfaced three existing bugs, all fixed here:

• the waiting music never looped, so it played once and stopped;
• the daily-double sound fired off the REST response instead of the
  broadcast, leaving a second host window silent;
• a preload map was built on every import and never read.

Testing

• make ci green (38 tests, 22 of them new for the payload validator).
• Verified end to end against a running server with a Socket.IO client: all
  five cues broadcast to a connected viewer, bad payloads rejected 400 with
  no broadcast, and the waiting-music flag surviving in /api/v1/state for
  clients that join mid-break.
• ONLINE_MODE confirmed reaching the front-end through /api/v1/state.

Audio playback itself still wants a human ear — worth one pass with two
windows before merging.

The design write-up is in docs/plans/2026-09-06-online-mode-viewer-sound.md.

🤖 Generated with Claude Code