Helve Hammer

Build a tiny browser game called "Helve Hammer".

Game spec
---------
A tilt-hammer forge driven by a water wheel, and the whole game is one number: hammer drop energy. The hammer head is raised by a cam on the wheel shaft and released to fall on the hot bar on the anvil; how hard it strikes is set by how far the cam lifts the head, which is set by wheel speed, which is set by the sluice you hold open. Open the sluice hard and the wheel races, the cam lifts high, and the hammer hits so hard it spreads the bar thin and splits its edges; go gentle and the bar only dents the surface and the work never forges. Between strokes the bar loses heat fast, and cold steel that gets hammered cracks, so the run is a fight to bring the bar to the target profile before it colours out, watching the hammer energy meter stay in its band while the heat meter falls. Hit the bar with Space to place and turn it (Up/Down rotate, Left/Right move it under the head), and Space also takes the stroke. A profile gauge shows the target cross-section against the current one and the number of good strokes needed. A forged bar pays by how close the profile is, how few wasted strokes, and heat left on the finish; three cracked bars ends the shift, and hard cools faster with a luggier wheel. Forge look: a big wooden water wheel dripping behind a shed wall, a helve pivoting on a brass pivot with a leather strap, a glowing bar with a fading colour ramp, a swageed anvil, and water rush plus a hammer clang in WebAudio.

Hard constraints — the game will be embedded in a sandboxed iframe on a static gallery site, and a headless browser will screenshot it:

1. Output exactly ONE self-contained HTML file. All CSS and JS inline. Zero external requests: no CDNs, no external fonts, images, or sounds, no fetch/XHR/WebSocket. Any sound must be synthesized with WebAudio.
2. The iframe sandbox is "allow-scripts allow-pointer-lock" (plus an autoplay permission). So: no localStorage, cookies, or indexedDB (opaque origin — access throws); no popups, window.open, or navigation; no access to the parent page; alert()/prompt()/confirm() are silently blocked.
3. The playfield must be visible within 800 ms of load — that is when the screenshot is taken. No dead white screen. If there is a start screen, make it visually rich.
4. Controls: keyboard AND mouse must both work, plus on-screen touch buttons for phones. Call preventDefault() on game keys (arrows, space) so the page never scrolls.
5. The view is 16:9 and must scale to fill the viewport with no overflow or scrollbars.
6. Show a visible score. If the genre has a losing state, show a game-over screen with a restart (button and a key). Idle/clicker games skip game over but still need clear numeric feedback.
7. If you track a score, report it to the arcade shell so the player's best is remembered between visits: on every score change, call parent.postMessage({ source: "ai-arcade", type: "score", score: <number> }, "*"). It is safe to call it no matter what the parent does with it.
8. Keep it tiny: aim for under 400 lines, 60 fps, no frameworks. That 400-line target does not apply to 3D games — true 3D (a camera and perspective-projected world) or pseudo-3D (projected road/track, depth-sorted sprites) — which need their own software renderer and typically land at 800–1400 lines. The rest of this constraint still binds every game: 60 fps, no frameworks, no external assets, and no padding to reach a length.
9. Difficulty: the arcade shell passes the player's chosen difficulty as a URL query parameter. Read it with new URLSearchParams(location.search).get("difficulty") — the value is "easy", "medium", or "hard" (missing or unknown means "medium"). Make the three levels meaningfully different — speed, lives, enemy pressure, reaction time, whatever fits the genre; clicker/idle games with no losing state use starting resources and upgrade cost curves instead. Show the active level in the HUD. Without the parameter the game must be fully playable at its default (medium) tuning.

Return only the complete HTML file, no commentary.