Adv 2.0 D&D layer: Phases 1-8 + Phase 9 SP1+SP2

Combines all uncommitted D&D work into one checkpoint:

Phases 1-8 (per gogobee_dnd_session_summary.md):
- Race/class/stats system, !setup flow, !sheet, !respec
- d20-vs-AC combat with race/class passives, auto-migration
- XP/level-up, skill checks, NPC refund hooks
- Equipment slot mapping, rarity, !rest short/long
- Pre-arm active abilities, resource pools
- Bestiary, !roll/!stats/!level, onboarding DM
- Audit fixes A-I, flavor wiring under internal/flavor/
- Phase 8 weapon dice + armor AC tables (gogobee_equipment_appendix)

Phase 9 SP1 — spell system foundations:
- 79 SpellDefinitions (76 in-scope + 3 reaction-deferred)
- dnd_known_spells, dnd_spell_slots tables
- pending_cast / concentration_* columns on dnd_character
- Slot tables for Mage/Cleric/Ranger, DC + attack-bonus math
- Long-rest refreshes slots; respec wipes spell state
- Auto-grant default known list on !setup confirm and auto-migration

Phase 9 SP2 — !cast / !spells / !prepare commands:
- Out-of-combat HEAL and UTILITY resolve immediately
- Damage/control/buff queue as pending_cast for next combat
- Audit-style save-then-debit, slot refund on save failure
- !cast --drop, concentration supersession, prep-cap enforcement
- Reaction spells refused with Phase 11 note

SP3 (combat-time resolution of pending_cast) and SP4 (full prep/learn
tests) are next. Build clean, full test suite green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/plugin/adventure_rival.go

@@ -247,6 +247,28 @@ func lastRivalChallengeTime() time.Time {
 	return time.Time{}
 }
 
+// pendingRivalChallengeForChallenged returns the active challenge where the
+// given user is the challenged party (i.e. the side that needs to act).
+// Returns nil if no challenge is pending or the user is only on the
+// auto-resolved challenger side.
+func pendingRivalChallengeForChallenged(userID id.UserID) *advRivalChallenge {
+	d := db.Get()
+	c := &advRivalChallenge{}
+	err := d.QueryRow(`
+		SELECT challenge_id, challenger_id, challenged_id, stake,
+		       round, player_score, rival_score, expires_at, created_at
+		FROM adventure_rival_challenges
+		WHERE challenged_id = ? AND expires_at > CURRENT_TIMESTAMP
+		ORDER BY created_at DESC LIMIT 1`, string(userID)).Scan(
+		&c.ChallengeID, &c.ChallengerID, &c.ChallengedID, &c.Stake,
+		&c.Round, &c.PlayerScore, &c.RivalScore, &c.ExpiresAt, &c.CreatedAt,
+	)
+	if err != nil {
+		return nil
+	}
+	return c
+}
+
 func hasActiveChallenge(userID id.UserID) bool {
 	d := db.Get()
 	var count int