Arcadia LootBox

## [1.2.4] - 2026-05-01

### Changed

- **Single clickable action row** — Only row 6 of the Preview menu is interactive now. Layout: `[All][F1][F2][◀][DRAW][▶][F3][F4][F5]`. The filter chips were moved up from row 5 onto row 6 alongside the prev/Draw/next controls, reclaiming row 5 entirely for item display.

- **28 items per page (up from 21)** — Reclaiming row 5 for content gives 4 full rows × 7 columns of rewards. Fewer pages to flip through.

- **Up to 5 rarity chips on the same row** — The 5 filter slots split around the Draw button (2 on the left, 3 on the right). If a lootbox somehow defines more than 5 rarities, the top 5 (highest rarity first) are shown.

### Performance

- **Frame baked once** — The stained-glass frame is now pre-built in the constructor and cloned into the container on each rebuild, instead of being recomputed per click.

- **Per-rarity counts cached** — Filter chip tooltips read from a pre-computed map instead of iterating the full loot table on every click.

- **Rarity ordering computed once** — The ordered list of present rarities is built in the constructor and reused as an immutable `List.copyOf`.

### Security

- **Anti-spam click cooldown** — A 75 ms minimum gap between non-Draw clicks in the Preview menu, and a 250 ms cooldown on right-click-in-air with a key. Blocks autoclicker-based GUI floods without affecting normal play.

- **Lootbox revalidation before opening** — Every Draw click re-checks `LootboxManager.exists(id)` and the player's range before consuming a key. Prevents opening a lootbox that was just deleted/reloaded.

- **Strict slot bounds in `clicked`** — Out-of-range slot ids are now rejected immediately, preventing crafted packets from triggering vanilla shift-click logic on player inventory slots.

- **Null-safe key lookup** — `LootHelper.countKeysInInventory` and `LootboxKeyItem.use` both guard against `null` registry keys and `null` definitions, preventing NPEs on mods that strip item registrations between reloads.

- **String sanitization in tooltips** — Display names from JSON are now stripped of control characters and capped at 64 chars before being rendered, defeating log-injection / overflow tricks via crafted lootbox configs.