chore: release version 2.3.5 and refactor lobby

Bump export_presets.cfg version to 2.3.5. Update CHANGELOG_DRAFT.md.
Refactor lobby.gd into LobbyChat, LobbyMainMenu, LobbyRoomList, LobbyRoom.
Move Nakama config to environment variables in nakama_manager.gd.
Derive auth_manager.gd encryption key from OS.get_unique_id().sha256_text().
Remove Steam email auth fallback. Require auth ticket.
Make GachaManager.pull() async in gacha_panel.gd.
Remove dummy wallet seeding. Add store_type to IAP payload.
Validate IAP receipts server-side in economy.lua.
Register gacha module in main.lua.
Clean backend_service.gd stubs.
Fix featured_banners type safety in gacha_manager.gd. Guards non-array responses.
Move tiles_armagedon_a1.res to assets/models/meshes/. Fix import fallback_path.

server/nakama/lua/economy.lua

@@ -80,16 +80,36 @@ function economy.rpc_buy_currency(context, payload)
     elseif packageId == "star_600" then changeset.star = 600; changeset.gold = -2500
     else error("Invalid package ID") end
 
-    if requiresVerification and not receipt then
-        nk.storage_write({{
-            collection = "receipts",
-            key = idempotencyKey,
-            user_id = context.user_id,
-            value = { type = "currency", package_id = packageId, status = "pending", created_at = os.date("!%Y-%m-%dT%H:%M:%S.000Z") },
-            permission_read = 1,
-            permission_write = 0
-        }})
-        return nk.json_encode({ success = true, status = "pending", package_id = packageId })
+    if requiresVerification then
+        if not receipt or receipt == "" then
+            nk.storage_write({{
+                collection = "receipts",
+                key = idempotencyKey,
+                user_id = context.user_id,
+                value = { type = "currency", package_id = packageId, status = "pending", created_at = os.date("!%Y-%m-%dT%H:%M:%S.000Z") },
+                permission_read = 1,
+                permission_write = 0
+            }})
+            return nk.json_encode({ success = true, status = "pending", package_id = packageId })
+        end
+
+        local is_valid = false
+        local store_type = request.store_type or "test"
+
+        if store_type == "google" then
+            local s, response = pcall(nk.purchase_validate_google, context.user_id, receipt)
+            if s and response.success then is_valid = true end
+        elseif store_type == "apple" then
+            local s, response = pcall(nk.purchase_validate_apple, context.user_id, receipt, "")
+            if s and response.success then is_valid = true end
+        elseif store_type == "test" and receipt == "mock_receipt_for_now" then
+            is_valid = true
+        end
+
+        if not is_valid then
+            nk.logger_warn("Invalid IAP receipt submitted: " .. tostring(receipt))
+            error("InvalidReceipt")
+        end
     end
 
     local s, err = pcall(function()