Prism Roll

Build a tiny browser game called "Prism Roll".

Game spec
---------
A colour-matching roll puzzle on an isometric grid. A cube with six coloured faces sits on a diamond-tiled slab; a roll is only legal when the face that would end up facing DOWN matches the colour of the tile being rolled onto, so the cube's current orientation dictates which of the four directions are open — most positions leave one or two legal moves and the route has to be read off the cube, not the floor. Every board is generated by walking a randomised self-avoiding path first and painting its tile colours from the cube's own face sequence, so a solution always exists; the far end of that path is the EXIT. Rolling onto an unpainted tile lights it and banks 25 points (reaching the EXIT adds a bonus weighted by unspent moves), a mismatched direction is refused and still costs a move, and Z rewinds one roll without refunding it, so undo can never be farmed for paint score. Controls: arrow keys or WASD to roll (up = north-west in iso space), click or tap an adjacent tile to roll onto it, click the cube itself to undo, R to retry, plus a four-way pad under pointer:coarse. HUD shows score, sector, moves left and percent painted; sectors advance to a bigger grid, and clearing them all ends the run. Difficulty via ?difficulty=easy|medium|hard scales grid size, colour count, hole count, the move-budget slack, and whether legal moves are outlined — easy outlines them, hard does not. Deep-indigo void look: beveled diamond tiles, a lit top face, radial glow, and a bobbing cube with shaded side faces.

Hard constraints — the game will be embedded in a sandboxed iframe on a static gallery site, and a headless browser will screenshot it:

1. Output exactly ONE self-contained HTML file. All CSS and JS inline. Zero external requests: no CDNs, no external fonts, images, or sounds, no fetch/XHR/WebSocket. Any sound must be synthesized with WebAudio.
2. The iframe sandbox is "allow-scripts allow-pointer-lock" (plus an autoplay permission). So: no localStorage, cookies, or indexedDB (opaque origin — access throws); no popups, window.open, or navigation; no access to the parent page; alert()/prompt()/confirm() are silently blocked.
3. The playfield must be visible within 800 ms of load — that is when the screenshot is taken. No dead white screen. If there is a start screen, make it visually rich.
4. Controls: keyboard AND mouse must both work, plus on-screen touch buttons for phones. Call preventDefault() on game keys (arrows, space) so the page never scrolls.
5. The view is 16:9 and must scale to fill the viewport with no overflow or scrollbars.
6. Show a visible score. If the genre has a losing state, show a game-over screen with a restart (button and a key). Idle/clicker games skip game over but still need clear numeric feedback.
7. If you track a score, report it to the arcade shell so the player's best is remembered between visits: on every score change, call parent.postMessage({ source: "ai-arcade", type: "score", score: <number> }, "*"). It is safe to call it no matter what the parent does with it.
8. Keep it tiny: aim for under 400 lines, 60 fps, no frameworks. That 400-line target does not apply to 3D games — true 3D (a camera and perspective-projected world) or pseudo-3D (projected road/track, depth-sorted sprites) — which need their own software renderer and typically land at 800–1400 lines. The rest of this constraint still binds every game: 60 fps, no frameworks, no external assets, and no padding to reach a length.
9. Difficulty: the arcade shell passes the player's chosen difficulty as a URL query parameter. Read it with new URLSearchParams(location.search).get("difficulty") — the value is "easy", "medium", or "hard" (missing or unknown means "medium"). Make the three levels meaningfully different — speed, lives, enemy pressure, reaction time, whatever fits the genre; clicker/idle games with no losing state use starting resources and upgrade cost curves instead. Show the active level in the HUD. Without the parameter the game must be fully playable at its default (medium) tuning.

Return only the complete HTML file, no commentary.