feat(world-builder): NPC placement, movement, and map persistence API (Closes #8) - #218

📄 api/src/server.ts:3092 📄 api/src/server.ts:3112 📄 api/src/server.ts:3146 📄 api/src/server.ts:3180
server.ts references config.mapsSourceDir in all four new NPC endpoints (GET/POST/PUT/DELETE), but the Config type and the config object in api/src/config.ts define no mapsSourceDir field. This is a TypeScript compile error, and at runtime the value is undefined, so every storage call resolves paths like undefined/mapa_N/npcs.json and the entire feature is broken. The codebase already resolves this directory via resolveMapsSourceDir() in repositories/worldBuilder.ts — export/reuse that helper (or add mapsSourceDir to config) and pass it to the storage functions.

📄 api/src/server.ts:8 📄 api/src/server.ts:3116
server.ts imports isValidGameNpcIndex from ./repositories/gameNpcs and calls it in the POST endpoint, but no such symbol is defined or exported in api/src/repositories/gameNpcs.ts (the only occurrences of the name in the codebase are the import and call site in server.ts). This breaks the build (missing named export) and would make NPC catalog validation impossible. Implement and export isValidGameNpcIndex in gameNpcs.ts, or use an existing catalog-lookup function.

📄 api/src/lib/mapNpcStorage.ts:175-189 📄 api/src/lib/mapNpcStorage.ts:212-226 📄 api/src/lib/mapNpcStorage.ts:238-246
placeMapNpc/moveMapNpc/removeMapNpc each do loadMapNpcPlacements → mutate in memory → saveMapNpcPlacements with no locking. Two concurrent requests to the same map both read the same base state and the last writer overwrites the first, silently dropping a placement (and defeating the duplicate-tile and MAX_NPCS_PER_MAP checks). Serialize writes per map (e.g. an async mutex/queue keyed by mapNum) or write atomically with a compare step.

📄 api/src/server.ts:3137-3143 📄 api/src/server.ts:3171-3178
The GET and POST endpoints reject mapNum <= 0, but the PUT /npcs/move and DELETE /npcs/:x/:y handlers only check Number.isInteger, so mapNum values of 0 or negative pass through to the storage layer and resolve directories like mapa_0 or mapa_-1. Add the same mapNum <= 0 rejection to the move and delete handlers for consistency.