add dev-only profiling with pprof, runtime/trace, and operation timing

Wire up Go's standard profiling toolkit so it's automatically available
in dev builds and completely absent from production. The profiling
package uses build tags (dev/!dev) to eliminate all pprof, trace, and
timing code from release binaries with zero new dependencies.

- backend/profiling: pprof HTTP server on :6060, /debug/trace endpoint,
  block/mutex profiling, and TimeOp helper for structured operation timing
- scripts/profile.sh: interactive menu-driven script that auto-selects
  free ports (8080-8089) so multiple profiles can be open simultaneously
- Instrumented key operations: app init, database init, player load/restore,
  queue set/restore
- Makefile targets: profile, profile-cpu, profile-heap, profile-trace
- .gitignore: exclude trace-*.out and *.pprof artifacts

main.go

@@ -14,6 +14,7 @@ import (
 	"yellowjacket/backend"
 	"yellowjacket/backend/assets"
 	"yellowjacket/backend/logging"
+	"yellowjacket/backend/profiling"
 	"yellowjacket/internal/dev"
 )
 
@@ -44,16 +45,22 @@ func main() {
 	slog.SetDefault(sLogger)
 	sLogger.Info("starting yellowjacket", "version", version, "commit", commit)
 
+	// Start profiling server (pprof + trace). In production builds this
+	// is a no-op — the compiler eliminates all profiling code.
+	stopProfiler := profiling.Start(sLogger)
+
 	// create asset handler
 	assetHandler, err := assets.NewAssetHandler(sLogger, frontendDistAssets)
 	if err != nil {
 		sLogger.Error("could not create asset handler", "err", err.Error())
+		stopProfiler()
 		os.Exit(1)
 	}
 
 	yjApp, err := backend.NewYellowJacketApp(sLogger, assetHandler)
 	if err != nil {
 		sLogger.Error("problem initializing yellowjacket", "err", err.Error())
+		stopProfiler()
 		os.Exit(1)
 	}
 
@@ -83,6 +90,9 @@ func main() {
 			WebviewGpuPolicy: linux.WebviewGpuPolicyAlways,
 		},
 	})
+
+	stopProfiler()
+
 	if err != nil {
 		sLogger.Error("application error", "err", err.Error())
 		os.Exit(1)