fix(security & perf): implement bearer session tokens, salted pbkdf2, object pooling and background caching

game/js/game.js

@@ -49,6 +49,9 @@ window.GameEngine = class GameEngine {
     }
     this.wave = new window.WaveSystem();
     this.combat = new window.CombatSystem();
+    if (window.ProjectilePool) {
+      this.projectilePool = new window.ProjectilePool(60);
+    }
 
     // Entities
     this.plants = [];
@@ -462,6 +465,9 @@ window.GameEngine = class GameEngine {
     this.wave.reset();
     this.combat.reset();
 
+    if (this.projectilePool) {
+      this.projectilePool.releaseAll(this.projectiles);
+    }
     this.plants = [];
     this.zombies = [];
     this.projectiles = [];
@@ -477,6 +483,12 @@ window.GameEngine = class GameEngine {
     document.getElementById('victory-modal').classList.add('hidden');
   }
 
+  spawnProjectile(x, y, row, type = 'pea', vy = 0, damage = 20, isCrit = false, targetX = 750) {
+    const proj = this.projectilePool ? this.projectilePool.get(x, y, row, type, vy, damage, isCrit, targetX) : new window.Projectile(x, y, row, type, vy, damage, isCrit, targetX);
+    this.projectiles.push(proj);
+    return proj;
+  }
+
   spawnSun(x, y, value = 25, isFalling = false, targetY = null) {
     let finalValue = value;
     if (this.roguelike && this.currentMode === 'roguelike' && this.roguelike.hasRelic('relic_sun_resonance') && !isFalling) {
@@ -2673,8 +2685,7 @@ window.GameEngine = class GameEngine {
           if (window.PvZAudio) window.PvZAudio.playExplosion();
         } else {
           // Rolling bowling nut
-          const ball = new window.Projectile(130, bounds.centerY, row, 'bowling', 0);
-          this.projectiles.push(ball);
+          const ball = this.spawnProjectile(130, bounds.centerY, row, 'bowling', 0);
           if (window.PvZAudio) window.PvZAudio.playPlant();
         }
         this.economy.selectedCard = null;
@@ -2868,11 +2879,18 @@ window.GameEngine = class GameEngine {
     }
     this.zombies = this.zombies.filter(z => !z.toRemove);
 
-    // 7. Projectiles
-    for (const proj of this.projectiles) {
+    // 7. Projectiles (in-place update with pooling release, eliminating GC allocations)
+    let projWriteIdx = 0;
+    for (let i = 0; i < this.projectiles.length; i++) {
+      const proj = this.projectiles[i];
       proj.update(dt);
+      if (!proj.toRemove) {
+        this.projectiles[projWriteIdx++] = proj;
+      } else {
+        if (this.projectilePool) this.projectilePool.release(proj);
+      }
     }
-    this.projectiles = this.projectiles.filter(p => !p.toRemove);
+    this.projectiles.length = projWriteIdx;
 
     // 8. Combat
     this.combat.update(dt, this);