🧹 Repo cleanup: committed build artifacts, dead files, and 4 competing server implementations (one crashes on startup)

## Summary
The repo has accumulated build output, dead files, and **four competing server implementations** — one of which crashes on startup because it imports modules that don't exist. This makes it genuinely hard for a new contributor to know what the app actually is.

## 1. Committed build output
`artifacts/` (Hardhat compile output, including the full OpenZeppelin artifact tree) and `cache/` are tracked in git. These are regenerated by `npx hardhat compile` and should be gitignored, as is standard for Hardhat projects.

- [ ] `git rm -r --cached artifacts cache` and add both to `.gitignore`

## 2. Dead / duplicate files
- `game_old.js` (14 KB) — superseded by `game.js`
- `index-old.html` — old landing page
- `welcome.html` — **byte-identical** to `index-old.html` (verify with `cmp welcome.html index-old.html`)
- `login-complex.html` (20 KB) — the pre-`fcb8b08` login flow, no longer referenced
- `auth-demo.html`, `demo-server.js`, `server.py`, `start-server.sh` — overlapping ad-hoc ways to serve the same static files

- [ ] Delete dead files (they remain in git history if ever needed)

## 3. Four server implementations, one of them broken
| File | What it is | Status |
|---|---|---|
| `server.js` | Express + JSON-file users + Resend email | works, is the real one |
| `backend/server.js` | "Full" Express app | **crashes on require**: imports `./routes/game`, `./routes/achievements`, `./middleware/auth`, etc. (`backend/server.js:16-29`) but `backend/routes/` contains only `auth.js` and `backend/middleware/` doesn't exist |
| `demo-server.js` | Minimal static server | redundant |
| `server.py` | Python static server | redundant |

Decide the canonical entry point (root `server.js` appears to be it — `package.json` `start` script points there), then either delete `backend/` or turn it into a tracked roadmap item instead of broken code.

- [ ] One documented way to run the app: `npm start`
- [ ] Remove or quarantine `backend/` until its missing routes/middleware/services actually exist

## Acceptance criteria
- Fresh clone → `npm install` → `npm start` works, and no other server files exist to confuse contributors
- `git ls-files | grep -E '^(artifacts|cache)/'` returns nothing
- Repo file count at root drops substantially (currently ~40 files at top level)

Start with package.json and root server.js to confirm the npm start entry point, then inspect the listed server, HTML, artifact, cache, and backend files before removing or quarantining redundant and broken implementations. Update .gitignore and verify with a fresh npm install, npm start, and git ls-files check that generated directories are untracked and only the documented server path remains.

Written by the indexing model from the issue text.