Replace IW4MAdmin with direct RCON for player counts

IW4M kept hitting a network wall (container -> host LAN IP -> IW4M
loopback bind) that we couldn't cleanly punch through, and the two-minute
!rt token added enough operational friction that the pause-all-deployments
gate never got a fair test. RCON gives us the same fact — how many
players are on a server right now — direct from each game server over
UDP, with no session, no token, no proxy.

- Add integrations/rcon.ts: dgram UDP client. rconGetPlayerCount() and
  rconGetStatus() parse both `status` (print + scoreboard) and
  `statusResponse` (info line + rows) dialects. Timeout via
  RCON_TIMEOUT_MS.
- Add komodoResolveGamePort() + extractUdpPort(). Reads Komodo's read
  API for a server, walks both docker-compose-style port objects and
  docker-run-style "host:container/udp" strings, caches into
  servers.game_port on first success.
- Replace pipelineReady() guard in sweep with a simple
  integrations-configured check. Same held/failed/manual outcomes,
  but keyed on RCON+Komodo instead of IW4M+auth-state.
- Worker's status refresh fans out per-server over RCON at concurrency=4
  so a 15-server fleet doesn't spike UDP.
- Schema: drop iw4m_match/iw4m_value, add game_port + rcon_host.
- Delete every auth artifact: TokenModal, auth store, auth-state module,
  /api/auth/token, /api/events/auth, iw4m.test.ts. Layout no longer
  mounts the modal, pipeline store no longer tracks a frozen state.
- README + .env.example + docker-compose.yml + komodo/stack.toml swap
  IW4M_* env for RCON_PASSWORD / RCON_HOST / RCON_TIMEOUT_MS. Same
  host.docker.internal:host-gateway extra_hosts entry, repurposed
  for RCON reach.
- Tests: add rcon.test.ts and komodo.test.ts, update sweep.test.ts to
  drop the auth-freeze case. 23/23 passing.

src/lib/server/config.ts

@@ -26,9 +26,15 @@ export const config = {
         apiKey: env.KOMODO_API_KEY ?? '',
         apiSecret: env.KOMODO_API_SECRET ?? ''
     },
-    iw4m: {
-        address: env.IW4M_ADDRESS ?? '',
-        clientId: env.IW4M_CLIENT_ID ?? ''
+    rcon: {
+        // Host every RCON packet is sent to. Defaults to the Docker
+        // host-gateway alias so the electric-cherry container can reach
+        // Plutonium servers running on the same host without knowing each
+        // container's internal IP.
+        host: env.RCON_HOST ?? 'host.docker.internal',
+        // Shared across the fleet — every server uses the same rcon_password.
+        password: env.RCON_PASSWORD ?? '',
+        timeoutMs: num('RCON_TIMEOUT_MS', 3_000)
     }
 } as const;
 
@@ -36,8 +42,8 @@ export function komodoConfigured(): boolean {
     return !!(config.komodo.address && config.komodo.apiKey && config.komodo.apiSecret);
 }
 
-export function iw4mConfigured(): boolean {
-    return !!(config.iw4m.address && config.iw4m.clientId);
+export function rconConfigured(): boolean {
+    return !!config.rcon.password;
 }
 
 export const betaSrc = () => `${config.sharedScripts}/betas`;