fix: key warden client state by WorldClient instead of UID

- _states is now keyed by the WorldClient instance (reference equality, stable for the whole connection) rather than client.UID

- client.UID is 0 at OnGamePhaseEnter (the cipher is created in MsgConnect before character selection assigns the UID), so UID-keying stored state under 0; Tick/IngestReport/OnDisconnect used the real UID and never matched it -> challenges never fired and reports were rejected as unregistered

- Tick iterates _states directly (no Kernel.Clients lookup, no dependency on UID being set); also fixes the disconnect-time state leak where TryRemove(realUID) missed the 0 key

- Dump resolves the /warden UID argument against the live client.UID