Add localStorage persistence for UI state

[ajbtech]

Summary

Adds localStorage persistence so users' party composition and encounter settings are automatically saved and restored across sessions. Introduces a pure persist.js module that handles serialization/deserialization with strict validation to prevent stale or hand-edited snapshots from corrupting the engine state.

Type of change

• New feature
• Bug fix
• Data/formula correction
• Docs / tooling

Implementation details

New module: src/persist.js

• defaultState() — factory for the canonical initial state
• serialize(state) — converts UI state to JSON-safe snapshot
• deserialize(raw) — rehydrates from storage with validation:
  • Drops non-canonical race/class values (via isRace/isClass checks)
  • Clamps numeric fields to valid ranges (levels 1–60, mob level 1–70, etc.)
  • Rounds floats and rejects non-finite numbers
  • Pads/truncates party arrays to exactly 6 members
  • Falls back to defaultState() on null/undefined/garbage input
• STORAGE_KEY — versioned string ("eq-xp-calculator/v1") for localStorage

Changes to src/ui.js

• Replaced inline state initialization with defaultState()
• Added loadFromStorage() — pulls snapshot on page load (before DOM build) with graceful fallback if localStorage is disabled or corrupted
• Added saveToStorage() — writes serialized state after every refresh() with best-effort error handling
• Minor: added patch date note to class XP penalties label

Documentation: architecture.md

• Added persist.js to the module breakdown with description of its role

Validation approach

The deserialize() function is defensive: it validates every field independently and falls back to defaults for any invalid data. This ensures a stale snapshot (e.g., from a previous version) or hand-edited JSON blob can never inject a non-canonical race/class or out-of-range number into the engine.

Checklist

• Added comprehensive unit tests for serialization, deserialization, validation, and edge cases (test/persist.test.js)
• npm test passes (185 lines of golden-value tests covering all validation paths)
• npm run lint passes
• npm run format:check passes
• src/xp.js remains pure (no DOM access)

https://claude.ai/code/session_019NDndqSRkT7BonKsEGXxfL