fix(combat): rate-limit bow shots + validate bow inputs

The bow release handler enforced no cooldown — the only client-driven action
in the engine without one (melee, harvesting and item use all rate-limit). Each
release also costs up to MaxRange/StepSize server raycasts to simulate the arc,
so the gate now runs BEFORE the arrow is spent and before the simulation.

- Combat.Bow.Cooldown (0.35s) added to CombatConfig + the EngineConfig schema,
  so it's tunable no-code in SurvivorCore Studio.
- onBowRelease honours def.weaponCooldown first, falling back to Bow.Cooldown.
  weaponCooldown was previously read only by the melee path, even though the
  authoring form offers it for every weapon — a bow cooldown was silently
  ignored. Its plugin label is now "Cooldown (s)" noting it covers both.
- A release with no matching draw is rejected (a real client fires BowDraw on
  press, BowRelease on release).
- BowDraw validates the sender is alive and holding a bow; it previously
  accepted anything from anyone.
- Aim points are checked for finiteness: a non-finite Vector3 defeats magnitude
  comparisons and would reach the raycast after the arrow was already spent.
- lastShot is cleared in PlayerRemoving alongside lastSwing/drawStart.

Affects v0.8.0 and earlier.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/combat.md

@@ -127,9 +127,14 @@ end)
 ```lua
 Config.override("Combat", {
     MeleeRange = 8, MeleeCooldown = 0.6, RequireLineOfSight = true, FriendlyFire = false,
-    Bow = { Gravity = 80, ProjectileSpeed = 180, MaxRange = 300, MinDrawDamageMult = 0.3, StepSize = 4 },
+    Bow = {
+        Gravity = 80, ProjectileSpeed = 180, MaxRange = 300, MinDrawDamageMult = 0.3, StepSize = 4,
+        Cooldown = 0.35, -- seconds between accepted shots (fallback when a bow sets no weaponCooldown)
+    },
 })
 ```
 
-Per-weapon `weapon*` values override these fallbacks. **Out of scope:** durability, blocking/parrying,
+Per-weapon `weapon*` values override these fallbacks — including **`weaponCooldown`, which governs
+both melee swings and bow shots**. Every shot is rate-limited server-side before any arrow is spent
+or any arc is simulated, so a client can't out-run its own fire rate. **Out of scope:** durability, blocking/parrying,
 and AoE are creator content via the hooks above; mob AI lives in [mobs.md](mobs.md).