Fix trigger brush aiming and PartyKit asset fallback

[agustin-lowpoly]

Summary

• fix thin damageable trigger brush hit testing
• allow multiplayer rooms to fall back to client gameplay facts when PartyKit's implicit static asset lookup misses
• keep explicit trusted gameplay fetchers strict

Verification

• node --test test/gameplay/weaponDamageableBrushTargets.test.mjs
• node --test test/multiplayer/partyRoomLifecycle.test.mjs
• ./node_modules/.bin/vite build
• browser multiplayer smoke against PartyKit with empty served assets: rejects 0