fix(networking): FIFO-queue api_client responses so concurrent requests don't collide

[ChronoFinale]

Two overlapping HTTP requests through api_client collide: one callback never fires and the other receives the wrong response body. This PR queues per-request handlers FIFO so each response reaches the callback that sent it.

The bug

api_client kept a single pending_callback and one self-clearing on_http_response/on_http_error pair on the transport, so only one request could safely be in flight. #7's "Leave Queue & Continue" guard leaves the queue and immediately replays the blocked action; when consumers guard lobby join with it, leave + join fire in the same tick. The join overwrites the leave's handler; the leave's response then runs the join's parser on the wrong body and errors (in game: "Failed to parse server response"); the handler clears itself, so the join's response is dropped and the leave callback never fires. The client is stranded; the bug is latent for any overlapping pair.

The fix

client.lua now keeps _queue, a FIFO of {on_response, on_error} entries, plus a transport router that pops the front entry for each inbound event.

before: reqA, reqB -> one shared slot (B overwrites A)
        respA -> B's parser (wrong body); respB -> dropped
after:  reqA -> _queue[1]; reqB -> _queue[2]
        respA -> pops A's handlers; respB -> pops B's handlers

Positional matching is correct because the MQTT worker (mqtt_thread.lua) drains tx_channel serially and blocks on each request, so responses return in send order. _enqueue is called immediately before each send, so queue order matches send order. Note _enqueue re-installs the router on every call; this is deliberate and idempotent (the closures only pop _queue).

The second commit (2ff2289) documents the three invariants this relies on — serial worker (responses arrive in send order), exactly one terminal event per request (request_with_retry is bounded), no in-place transport swap (reconnect builds a fresh client with an empty _queue) — and adds a tripwire: under those invariants an event with an empty queue is impossible, so the router warns loudly instead of misrouting silently.

How to review

Review as one diff; the second commit only adds comments, the tripwire, and its test.

• Core change: networking/api_client/client.lua (_install_router, _enqueue, and the shared _setup_http_callback/_setup_json_callback moved onto the queue). Start here.
• Mechanical conversions: account.lua (discord link/unlink) and lobby.lua (set metadata, enable chat, send chat) were the inline single-slot call sites. unlink_discord and set_lobby_metadata collapse onto _setup_json_callback; the other three keep their bespoke parsers, now passed to _enqueue, to preserve behavior. Nothing bypasses the queue.

Tests

luajit dev/test_api_client_fifo.lua

Standalone script from the repo root; not wired into CI. Green: overlapping leave + join each get their own response; an error pops only the front request; the empty-queue tripwire warns. Red control: a transcription of the old single-slot design reproduces the bug (leave callback never fires; join callback gets the leave body and errors).

Related

• feat(matchmaking): queue guard for run start + reusable guard_queued helper #7 adds the "Leave Queue & Continue" guard whose leave-then-replay creates the overlap. The PRs merge independently, but that flow needs this fix.
• Downstream feat(lobby): block create/join while in matchmaking BalatroMultiplayer#496 and feat(lobby): block create/join while in matchmaking V-rtualized/BalatroSpeedrunning#1 guard lobby join with it and need both feat(matchmaking): queue guard for run start + reusable guard_queued helper #7 and this PR merged first.