feat(player-ui): add pre-reader controls and onboarding

PLANS.md

@@ -1267,7 +1267,7 @@ confirmation remains pending.
 
 ## Milestone 015 — Pre-reader child-friendly game experience
 
-**Status:** `NOT_STARTED`
+**Status:** `IN_PROGRESS`
 
 ### Objective
 
@@ -1363,15 +1363,42 @@ rules.
 
 ### Evidence
 
-Completion evidence is not yet available because implementation has not
-started. A baseline inspection of the live game at a `412 x 915` viewport on
-2026-09-08 found that the visible maze occupied only `80 x 140` pixels inside a
-`381 x 729` play area, status labels were approximately `8--10.56` pixels,
-status icons were `23 x 23` pixels, the player was identified primarily as
-`P1`, and no directional touch controls were visible in the game area. These
-observations define the principal redesign targets. The planned joystick
-replaces directional-arrow buttons rather than adding them. Expected completion
-evidence includes before-and-after viewport captures, deterministic browser
-tests, `bash scripts/run_host_tests.sh`, a reproducible `buildfs` size report,
-and the facilitated child-usability confirmation or an explicitly approved
-deviation.
+The implementation and automated verification are complete; the required
+representative pre-reader observation or owner-approved evidence deviation
+remains pending.
+
+- The player screen now uses circle and diamond character shapes instead of
+  `P1`/`P2`, icon-and-shape ownership markers for keys and exits, dynamic
+  projection sizing from 32 to 72 CSS pixels per cell, a 180 CSS-pixel
+  joystick (172 on phones), and an icon-only visible mute, reduced-motion, and
+  onboarding-replay control group. The mobile directional-button cluster stays
+  hidden while keyboard and swipe input remain available.
+- The joystick clamps its handle to the circular base, has a 20-pixel dead
+  zone and 18% axis hysteresis, emits only cardinal movement intentions, and
+  schedules repeats from 360 to 170 ms. It resets on pointer release or
+  cancellation, pause, disconnect, browser blur, and hidden-document events;
+  the fastest local repeat remains above the 150 ms authoritative cooldown.
+- First active player projection now opens an eight-step, icon-first Russian
+  walkthrough for drag, release, walls, key, vision, compass, exit, and the
+  other player. It can be replayed or skipped locally. The new
+  `docs/PRE_READER_USABILITY.md` records the final privacy-safe observation
+  protocol without collecting child-identifying data.
+- On 2026-09-09, `bash scripts/run_host_tests.sh` passed every host suite,
+  including 15 browser tests. The focused browser coverage verifies joystick
+  cardinal direction and bounded travel, dead zone, monotonic repeat rate,
+  hysteresis, dynamic mobile cell sizing, onboarding bounds, reset paths,
+  mute and reduced-motion controls, local assets, Russian UI, and existing
+  protocol/observer constraints. Web asset reproducibility reported SHA-256
+  `13f95418169fb38d277d86f3324a4dbc3fa8b5e5e2e9fb7bde9439aa2f7b75e4`
+  using 23,950 of 1,572,864 allowed compressed bytes.
+- On 2026-09-09, `pio run -e esp32-c6-devkitm-1` passed with 58,868 of
+  327,680 RAM bytes and 1,027,934 of 2,097,152 application bytes. Its
+  `firmware.bin` SHA-256 was
+  `87cfffaaa9b119794707c9caedc3da7f3f015d540fc1149d74e7cc0a1ecd2841`.
+  `pio run -e esp32-c6-devkitm-1 --target buildfs` passed; the fixed LittleFS
+  image used 2,031,616 of 2,031,616 bytes and SHA-256
+  `ea6813e603d883a1f6b79a9f9efbd20e7d02f010052210716a89d7e863716415`.
+- Acceptance criterion 11 still requires the facilitated representative
+  pre-reader observation from `docs/PRE_READER_USABILITY.md`, or a
+  project-owner-approved documented deviation. Therefore Milestone 015 remains
+  `IN_PROGRESS`; Milestone 016 has not been started.