Fix review issues in analytics integration

1. Race condition: session_end now waits for an in-flight
   session_start promise before sending, so quick restarts
   don't drop the end call.

2. beforeunload: replaced sendBeacon (which can't set headers)
   with fetch(..., keepalive: true) so the X-API-Key header
   is included and the backend doesn't 401.

3. Stats double-counting: removed stats_record_damage_dealt
   and stats_record_kill from damage_entity (which was called
   for all damage including player deaths). Now only recorded
   at player-sourced call sites (projectile hits, stomps).

4. Removed const-cast: analytics_session_end now takes
   GameStats* (non-const) since stats_update_score mutates it.

5. beforeunload now uses stashed stats from the last C-side
   session_end call instead of hardcoded zeroes. Session ID is
   cleared synchronously before async fetch to prevent races.

6. Removed unused stdint.h include from stats.h.

src/game/analytics.h

@@ -11,7 +11,8 @@ void analytics_init(void);
 void analytics_session_start(void);
 
 /* End the current analytics session with final stats.
+ * Computes the composite score before sending.
  * end_reason: "death", "quit", "timeout", or "completed". */
-void analytics_session_end(const GameStats *stats, const char *end_reason);
+void analytics_session_end(GameStats *stats, const char *end_reason);
 
 #endif /* JNR_ANALYTICS_H */