chore: move audit tools tests/audit, add scratch/ gitignored

Audit tools are test code (bug-finders), not scripts. Move to tests/audit/.
scripts/ now only replay-combat (live demo tool).

scratch/ = gitignored throwaway. Repro scripts, exploration, debug.

Update DEVELOPMENT.md + scripts/README to match new layout.

scripts/README.md

@@ -1,13 +1,11 @@
 # scripts/
 
-Manual tools. NOT unit tests. Math.random, non-deterministic.
-
-Used to FIND bugs. Unit tests (in `*/tests/`) LOCK them.
+Manual demo tool. NOT test.
 
 ## replay-combat.js
 
-Drives full combat through live backend via ws adapter (same contract as App).
-Player display live-updates. Use to watch UI react to state changes.
+Live backend demo. Drives full combat via ws adapter (same contract as App).
+Player display live-updates. Watch UI react to state changes.
 
 ```bash
 # start backend + frontend first (see docs/DEVELOPMENT.md)
@@ -20,33 +18,8 @@ removeParticipant, addParticipant (reinforcements), updateParticipant,
 pause/resume, reorderParticipants, endEncounter. Revives dead each round
 to sustain full round count.
 
-## audit-rotation.js
+## See also
 
-Pure turn.js simulation of replay op sequence. Detects rotation violations
-(skip/dupe per round). Pinpointed BUG-1 (addParticipant + pause corrupts).
-
-```bash
-node scripts/audit-rotation.js
-```
-
-Bisect: comment/uncomment op blocks to isolate triggering combo.
-
-## audit-state.js
-
-Expanded invariant bug-finder. 9 check classes per round:
-
-1. rotation integrity
-2. HP bounds
-3. isActive consistency
-4. turnOrder no dup ids
-5. turnOrder ids all active
-6. currentTurn valid + active
-7. deathSave range + reset on revive
-8. removeParticipant orphans
-9. undo support
-
-```bash
-node scripts/audit-state.js [rounds]   # default 100
-```
-
-See TODO.md for bugs found.
+- `tests/audit/` — exploratory bug-finders (manual run, non-deterministic)
+- `{shared,server,src}/tests/` — jest unit/integration/characterization
+- `scratch/` — gitignored throwaway