Convert Twitch controls to video overlay

docs/testing.md

@@ -36,6 +36,37 @@ Twitch identities; they do not require credentials.
 The local-only endpoints `/api/dev/spawn` and `/api/dev/redemption` exist only while
 `TWITCH_ENABLED` is false.
 
+## Local video-overlay verification
+
+The production viewer path is `/extension`. It is safe to open directly, but it
+waits for Twitch authorization when it is not inside Twitch. While running the
+synthetic local backend, open:
+
+```text
+http://localhost:3000/extension?dev=1&debug=1
+```
+
+`dev=1` exposes the existing **Local viewer login** inside the overlay so the
+same controller and API flow can be exercised without Twitch. `debug=1` draws a
+cyan control-region boundary and a pink controller boundary. Both switches are
+accepted only on `localhost`, `127.0.0.1`, or `[::1]`, so the diagnostics cannot
+be enabled on the deployed Extension origin.
+
+Verify at 1920×1080, 1280×720, and a narrower or 4:3 viewport:
+
+- the document and empty overlay canvas remain transparent;
+- controls stay within the upper-left debug boundary and remain readable;
+- the dungeon, log, branding, and status tiles are absent from `/extension`;
+- only buttons (and the local-only login form) accept pointer events;
+- Up, Down, Left, Right, Attack, Heal, and Pass reach the same backend routes;
+- missing character, dead character, non-player phase, and zero-AP states still
+  disable the controls; and
+- loading `/` still presents the full local game and controller.
+
+Remove the query string for the production-shaped local view. Twitch-hosted
+testing still must cover identity sharing, player ownership, theater mode,
+fullscreen, embeds, ads/pauses, and Twitch player-control safe zones.
+
 ## Live-channel campaign
 
 After completing `docs/twitch-setup.md`, use two follower accounts and one