feat(lobby): block create/join while in matchmaking

[ChronoFinale]

Beta testers could create or join a private lobby while a matchmaking search was active, ending up searching and in a lobby at once. The search kept running server-side with no feedback. This PR blocks both lobby entry points while queued. Two BalatroMultiplayerAPI PRs must merge first (see Depends on).

The bug

MP.pvp_create_private_lobby and MP.pvp_join_lobby had no queue check. Nothing stopped a queued player from allocating or joining a lobby mid-search.

The fix

Both functions now run this guard before touching the API (create's closure re-enters MP.pvp_create_private_lobby instead):

if MPAPI.matchmaking.guard_queued(function() return MP.pvp_join_lobby(code) end) then
	return
end

guard_queued(replay) lives in the API (Balatro-Multiplayer/BalatroMultiplayerAPI#7). If the player is queued, it shows a "Leave Queue & Continue" overlay, stashes replay, and returns true; the caller returns early. If not queued, it returns false and the function proceeds. Clicking the overlay button leaves the queue and runs the stashed replay.

The replay re-enters this mod's own function, not MPAPI.create_lobby / MPAPI.join_lobby. Only the mod function runs MP.setup_lobby_mirror and the CONNECTED handler that moves the client into the lobby. Replaying the API primitive would join or create server-side (the other player sees you) but leave the client stuck on the PvP main menu. That is why the guard lives here and not inside the API primitives.

How to review

• pvp_api/flow.lua: the core change. Two guard blocks, one per entry point. Nothing else changes.
• tests/test_lobby_guard_while_queued.lua: new standalone test.

Tests

Run from the repo root: luajit tests/test_lobby_guard_while_queued.lua. No game install needed. Cases:

• Blocked while searching: no API call, no mirror, overlay shown, replay stashed.
• Replay after leaving the queue: MPAPI.join_lobby and MP.setup_lobby_mirror both run.
• Not searching: join proceeds normally, no overlay.
• Same blocked-then-replay pair for create.
• Red control: a replay that calls the API primitive directly joins server-side but never runs setup_lobby_mirror, reproducing the original stranding bug.

Depends on

Merge both before this PR:

• feat(matchmaking): queue guard for run start + reusable guard_queued helper BalatroMultiplayerAPI#7 adds MPAPI.matchmaking.guard_queued and the overlay. The call here is not nil-guarded, so running against an API without that helper errors at these entry points.
• fix(networking): FIFO-queue api_client responses so concurrent requests don't collide BalatroMultiplayerAPI#10 gives api_client a FIFO response queue. "Leave Queue & Continue" fires a leave and a join/create back to back; without the FIFO fix the overlapping requests clobber the single callback slot, so one callback never fires and the other gets the wrong response body.

What it looks like

Clicking a lobby create/join button while searching shows the shared guard overlay (from the API's queue-guard PR) instead of silently stranding the queue — with the search visibly running in the status panel:

Full annotated gallery of the guard's behavior (every entry point, every button outcome): VERIFICATION.md