feat: sp_fakehp — live value-spoof via int-encoder redirect (Phase 1 PoC)

IntEncoderDetour now redirects the encoder's value ptr (rcx/arg d) to a native
scratch int holding the fake value when the field offset matches a registered
spoof. Encoder encodes the fake into the bitstream; real entity memory untouched
= true send-proxy. sp_fakehp <value> installs+spoofs m_iHealth (728); sp_fakehp_off
clears + uninstalls the detour when no spoofs remain (zero footprint otherwise).
Phase 1 = uniform (all clients/entities); per-client filtering is Phase 2.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>