Thwack

First release.

- Client-side hit detection: the aim ray is re-cast at click time against the
  rendered (interpolated) hitbox instead of the tick position.
- Instant impact prediction: sound, hurt flash, crit particles and knockback
  play locally, with the server's duplicate sound swallowed on arrival.
- Server-side lag compensation: one hitbox snapshot per player per tick for
  one second; hits are validated against the position the attacker saw,
  within min(maxRewindMs, ping + 100) ms.
- Vanilla first: a hit a vanilla server would accept is always accepted.
  Damage stays server-authoritative.
- F6 diagnostic panel, F7 live toggle, /thwack command, JSON config both sides.

Beta: the rewind path has not yet been observed under real latency.