fix(skin): cache-bust query ?v=20260614 for character-assets URLs

After backend CORS rollout users had stale CORS-failure cached for
Mixamo GLB. Adding a query suffix forces browsers to re-fetch the URL
instead of replaying the cached failure.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/KubikonPlayer/GameMenu.jsx

@@ -616,7 +616,7 @@ function PlayerCard({ player, isMe, isFriend, isPending, onAddFriend }) {
                 && window.location.hostname === 'localhost')
                 ? 'http://localhost:3000'
                 : 'https://rublox.pro';
-            avatarUrl = `${base}/character-assets/skins/${player.skin}.png`;
+            avatarUrl = `${base}/character-assets/skins/${player.skin}.png?v=20260614`;
         } else {
             // Legacy R15: путь по старому шаблону.
             avatarUrl = `/kubikon-assets/characters/${player.skin}/avatar.png?v=2026_05_27`;

src/engine/PlayerController.js

@@ -827,7 +827,7 @@ export class PlayerController {
                     ? 'http://localhost:3000'
                     : 'https://rublox.pro';
                 return {
-                    file: `${base}/character-assets/skins/${typeId}.glb`,
+                    file: `${base}/character-assets/skins/${typeId}.glb?v=20260614`,
                     isR15: false,
                     kind: 'non-humanoid-rigged',  // Mixamo-rig, не R15
                     overrides: {},