fix(server): address PR #23 review — 4 critical bugs, 3 warnings, 11 suggestions

Critical fixes:
- Add PendingRecognitionWire serialization roundtrip test
- Check Option return from delay.cancel() before logging
- InputQueue capacity limit (1000) with drop-oldest and warning
- TODO in observation.rs references ticket #450

Warning fixes:
- Hot-reload guards against invalid/empty content root
- Location header mismatch warning in line pool indexing
- walk_yaml() depth limit (100) against symlink loops
- Consecutive reload failure counter (warns after 5+)

Test additions:
- Negative prerequisite filtering test for monologue lines
- Integration test for pending_recognitions in observer snapshot
- Eavesdrop threshold ordering assertion (Careful < default)

Documentation:
- Playtesting expectation comments on delay constants
- is_pending() scalability note for future NPC cognitive delay
- ID format regex validation in line pool spec
- BTreeMap vs sort() ordering clarification in loader
- Multiplayer TODO in relationships.rs references D-010
- ContentSlug ticket #452 filed for entity slug resolution

394 tests, 0 failures.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/tests/serialization.rs

@@ -480,6 +480,43 @@ fn snapshot_v6_full_inventory_roundtrip() {
     assert_eq!(decoded.player_inventory[8].slot, 8);
 }
 
+/// PendingRecognitionWire round-trips through MessagePack (#423, D-060).
+/// Guards against cognitive delay wire data corruption during serialization.
+#[test]
+fn pending_recognition_wire_roundtrip() {
+    let mut snapshot = test_snapshot(0, vec![]);
+    snapshot.pending_recognitions = vec![
+        PendingRecognitionWire {
+            entity_id: 42,
+            x: 10.5,
+            y: 20.0,
+            z: 0,
+            remaining_ticks: 4,
+            total_delay_ticks: 6,
+        },
+        PendingRecognitionWire {
+            entity_id: 99,
+            x: 15.0,
+            y: 8.5,
+            z: 1,
+            remaining_ticks: 1,
+            total_delay_ticks: 3,
+        },
+    ];
+
+    let bytes = rmp_serde::to_vec_named(&snapshot).expect("serialize");
+    let decoded: ObserverSnapshot = rmp_serde::from_slice(&bytes).expect("deserialize");
+
+    assert_eq!(decoded.pending_recognitions.len(), 2);
+    assert_eq!(decoded.pending_recognitions[0].entity_id, 42);
+    assert_eq!(decoded.pending_recognitions[0].remaining_ticks, 4);
+    assert_eq!(decoded.pending_recognitions[0].total_delay_ticks, 6);
+    assert!((decoded.pending_recognitions[0].x - 10.5).abs() < f32::EPSILON);
+    assert_eq!(decoded.pending_recognitions[1].entity_id, 99);
+    assert_eq!(decoded.pending_recognitions[1].z, 1);
+    assert_eq!(decoded.pending_recognitions[1].total_delay_ticks, 3);
+}
+
 /// All VerbKind variants must survive MessagePack round-trip (#421, D-057).
 /// Guards against serde mapping breakage when new verbs are added.
 #[test]