Fix region loader to find the manifest in prod (dist/) — dev-vs-prod path (v0.20.0, completes #16 P1)

v0.19.0's region-level ownership did not activate in the production image:
server/regions.ts loadRegions only looked in public/, but the Docker image keeps
only dist/ (Vite copies public/* -> dist/ at build), so the loader found nothing
and expandCountriesToKeys degraded to a no-op — fresh games kept raw ISO_A3 codes
instead of region keys (the client's own /region-keys.json fetch still worked,
since the client is served from dist/).

loadRegions now probes public/ (dev) then dist/ (prod, == clientDir) and uses the
first directory holding both files. A new test covers the prod-only (dist/), dev
(public/), and empty-root (no data) layouts.

server/regions.test.ts

@@ -1,5 +1,8 @@
-import { afterAll, beforeEach, describe, expect, it } from 'vitest';
+import { afterAll, afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { fileURLToPath } from 'node:url';
+import { copyFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 import {
   allTerritoryKeys,
   expandCountriesToKeys,
@@ -101,3 +104,50 @@ describe('regions (region-key loader, v0.19 #16 P1)', () => {
 
   afterAll(() => resetRegions());
 });
+
+describe('loadRegions resolves the manifest per environment (dev public/ vs prod dist/)', () => {
+  const realRoot = root;
+  // A root that mimics the prod Docker image: no public/, the region files live
+  // in dist/ (where Vite copies public/* at build). This is the exact layout that
+  // broke v0.19.0 in prod (the loader only looked in public/).
+  const base = mkdtempSync(path.join(tmpdir(), 'history-regions-'));
+  const prodRoot = path.join(base, 'prod');
+
+  beforeEach(() => {
+    mkdirSync(path.join(prodRoot, 'dist'), { recursive: true });
+    copyFileSync(
+      path.join(realRoot, 'public', 'region-keys.json'),
+      path.join(prodRoot, 'dist', 'region-keys.json'),
+    );
+    copyFileSync(
+      path.join(realRoot, 'public', 'regions.geo.json'),
+      path.join(prodRoot, 'dist', 'regions.geo.json'),
+    );
+  });
+
+  afterEach(() => resetRegions());
+
+  afterAll(() => {
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  it('loads from dist/ when public/ is absent (the prod container layout)', () => {
+    expect(loadRegions(prodRoot)).toBe(true);
+    expect(hasRegionData()).toBe(true);
+    expect(validKeys().size).toBe(1796);
+    expect(expandCountriesToKeys(['FRA'])).toHaveLength(42);
+  });
+
+  it('still loads from public/ (the dev layout, the first candidate)', () => {
+    expect(loadRegions(realRoot)).toBe(true);
+    expect(validKeys().size).toBe(1796);
+  });
+
+  it('returns false and no data when neither public/ nor dist/ holds the files', () => {
+    const emptyRoot = path.join(base, 'empty');
+    mkdirSync(emptyRoot, { recursive: true });
+    expect(loadRegions(emptyRoot)).toBe(false);
+    expect(hasRegionData()).toBe(false);
+    expect(validKeys().size).toBe(0);
+  });
+});