feedback5 R6: check that sim and match stay off the net and the client

tools/check-imports.mjs lists boundary hits and exits 1 only with --strict. The current hit is the Node data loader's node:fs, node:path and node:url. server/data.js stays allowed.

package.json

@@ -36,7 +36,8 @@
     "doctor": "node tools/doctor.mjs",
     "launch": "node scripts/launch.mjs",
     "lint": "eslint .",
-    "typecheck": "tsc --noEmit --checkJs -p jsconfig.json"
+    "typecheck": "tsc --noEmit --checkJs -p jsconfig.json",
+    "check:imports": "node tools/check-imports.mjs"
   },
   "engines": {
     "node": ">=22"