feat: custom systems mark fields as the GM's to set, and give NPCs th…

[over2take]

…eir own layout and tiers

A sheet field can say edit: 'gm' (XP, awarded items): its owner sees it and cannot change it, by a single edit, a batch edit or an upload, while the GM, a granted admin and the GM's own sheet window still can. Derived values stay locked by the recompute, as on the built-ins.

A system's npc section gives NPCs a stat-block layout of their own and GENERATE_SHEET tiers (label, token HP and defense, starting values, derived values worked out). Both layouts share the system's rules, so a field on both must be linked the same way; only the character sheet says what players may see. A tier that leaves out HP or defense keeps the token's own.

Built-in systems mark no GM fields and keep their code tiers, looked up first.

Summary

Test plan

• Tested locally
• Tests pass

Pre-merge checklist

Code quality:

• Code follows project style
• No breaking changes (or clearly documented)
• No console errors or warnings

Version & Release:

• Version bumped? If releasing to users, update:
  • frontend/package.json version
  • docker-compose.yml APP_VERSION
  • CHANGELOG.md with release notes
• GitHub Actions will auto-tag Docker images with the new version

Before merging to main:

• All tests passing
• PR reviewed and approved
• Branch is up to date with main
• No merge conflicts

Related issues