Replace IW4MAdmin with direct RCON for player counts

IW4M kept hitting a network wall (container -> host LAN IP -> IW4M
loopback bind) that we couldn't cleanly punch through, and the two-minute
!rt token added enough operational friction that the pause-all-deployments
gate never got a fair test. RCON gives us the same fact — how many
players are on a server right now — direct from each game server over
UDP, with no session, no token, no proxy.

- Add integrations/rcon.ts: dgram UDP client. rconGetPlayerCount() and
  rconGetStatus() parse both `status` (print + scoreboard) and
  `statusResponse` (info line + rows) dialects. Timeout via
  RCON_TIMEOUT_MS.
- Add komodoResolveGamePort() + extractUdpPort(). Reads Komodo's read
  API for a server, walks both docker-compose-style port objects and
  docker-run-style "host:container/udp" strings, caches into
  servers.game_port on first success.
- Replace pipelineReady() guard in sweep with a simple
  integrations-configured check. Same held/failed/manual outcomes,
  but keyed on RCON+Komodo instead of IW4M+auth-state.
- Worker's status refresh fans out per-server over RCON at concurrency=4
  so a 15-server fleet doesn't spike UDP.
- Schema: drop iw4m_match/iw4m_value, add game_port + rcon_host.
- Delete every auth artifact: TokenModal, auth store, auth-state module,
  /api/auth/token, /api/events/auth, iw4m.test.ts. Layout no longer
  mounts the modal, pipeline store no longer tracks a frozen state.
- README + .env.example + docker-compose.yml + komodo/stack.toml swap
  IW4M_* env for RCON_PASSWORD / RCON_HOST / RCON_TIMEOUT_MS. Same
  host.docker.internal:host-gateway extra_hosts entry, repurposed
  for RCON reach.
- Tests: add rcon.test.ts and komodo.test.ts, update sweep.test.ts to
  drop the auth-freeze case. 23/23 passing.

src/routes/+layout.svelte

@@ -1,16 +1,13 @@
 <script lang="ts">
     import { onMount } from 'svelte';
-    import { startAuthStream } from '$ui/stores/auth.js';
     import { startPipelineStream } from '$ui/stores/pipeline.js';
     import { startServerStream } from '$ui/stores/servers.js';
-    import TokenModal from '$ui/components/TokenModal.svelte';
     import { page } from '$app/stores';
 
     interface Props { children: import('svelte').Snippet }
     let { children }: Props = $props();
 
     onMount(() => {
-        startAuthStream();
         startPipelineStream();
         startServerStream();
     });
@@ -28,8 +25,6 @@
     </main>
 </div>
 
-<TokenModal />
-
 <style>
     :global(html, body) {
         margin: 0;

src/routes/+page.svelte

@@ -9,8 +9,8 @@
         name: string;
         komodo_type: string;
         komodo_name: string;
-        iw4m_match: string | null;
-        iw4m_value: string | null;
+        game_port: number | null;
+        rcon_host: string | null;
         last_players: number | null;
         held: HeldRow[];
     }

src/routes/api/auth/token/+server.ts

@@ -1,30 +0,0 @@
-import { json } from '@sveltejs/kit';
-import { loginWithToken } from '$lib/server/integrations/iw4m.js';
-import { getAuthState, setAuthState } from '$lib/server/integrations/auth-state.js';
-import { kick } from '$lib/server/pipeline/worker.js';
-
-export async function GET() {
-    return json(getAuthState());
-}
-
-export async function POST({ request }: { request: Request }) {
-    const body = (await request.json().catch(() => ({}))) as { token?: string };
-    const token = (body.token ?? '').trim();
-    if (!/^[a-zA-Z0-9]{4}$/.test(token)) {
-        return json({ ok: false, error: 'token must be exactly 4 alphanumeric characters' }, { status: 400 });
-    }
-    const res = await loginWithToken(token);
-    if (!res.ok) {
-        setAuthState({ kind: 'stale', reason: res.reason === 'rejected' ? 'rejected' : 'unreachable' });
-        return json({ ok: false, error: res.message }, { status: res.reason === 'rejected' ? 401 : 502 });
-    }
-    setAuthState({ kind: 'ready', token, cookie: res.cookie, expiresAt: res.expiresAt });
-    // Fresh cookie → immediately drain any queued restarts.
-    void kick();
-    return json({ ok: true, expiresAt: res.expiresAt });
-}
-
-export async function DELETE() {
-    setAuthState({ kind: 'missing' });
-    return json({ ok: true });
-}

src/routes/api/events/auth/+server.ts

@@ -1,47 +0,0 @@
-import { subscribe } from '$lib/server/pipeline/bus.js';
-import { getAuthState } from '$lib/server/integrations/auth-state.js';
-
-const encoder = new TextEncoder();
-const HEARTBEAT_MS = 5_000;
-
-export async function GET() {
-    let heartbeat: NodeJS.Timeout | null = null;
-    let unsubscribe: (() => void) | null = null;
-
-    const stream = new ReadableStream<Uint8Array>({
-        start(controller) {
-            const push = () => {
-                const s = getAuthState();
-                const payload = {
-                    type: 'auth-state',
-                    state: s,
-                    msRemaining: s.kind === 'ready' ? Math.max(0, s.expiresAt - Date.now()) : undefined
-                };
-                controller.enqueue(encoder.encode(`event: auth-state\ndata: ${JSON.stringify(payload)}\n\n`));
-            };
-
-            unsubscribe = subscribe((event) => {
-                if (event.type === 'auth-state') {
-                    controller.enqueue(encoder.encode(`event: auth-state\ndata: ${JSON.stringify(event)}\n\n`));
-                }
-            });
-            push();
-            // The auth stream double-serves as the token-countdown feed; the
-            // frontend uses the msRemaining to render a per-second ticker,
-            // so we push every 5s even without a state change.
-            heartbeat = setInterval(push, HEARTBEAT_MS);
-        },
-        cancel() {
-            if (heartbeat) clearInterval(heartbeat);
-            if (unsubscribe) unsubscribe();
-        }
-    });
-
-    return new Response(stream, {
-        headers: {
-            'Content-Type': 'text/event-stream',
-            'Cache-Control': 'no-cache, no-transform',
-            Connection: 'keep-alive'
-        }
-    });
-}

src/routes/servers/[name]/+page.svelte

@@ -8,8 +8,8 @@
         komodo_type: string;
         komodo_name: string;
         komodo_server: string | null;
-        iw4m_match: string | null;
-        iw4m_value: string | null;
+        game_port: number | null;
+        rcon_host: string | null;
         last_players: number | null;
         last_checked_at: string | null;
         held: Array<{ target: string; slug: string }>;
@@ -49,8 +49,12 @@
             <div class="v">{server.komodo_type} · {server.komodo_name}</div>
         </div>
         <div class="stat">
-            <div class="k">iw4m</div>
-            <div class="v">{server.iw4m_match ?? '—'} · {server.iw4m_value ?? '—'}</div>
+            <div class="k">rcon</div>
+            <div class="v">{server.rcon_host ?? 'default'} · port {server.game_port ?? '—'}</div>
+        </div>
+        <div class="stat">
+            <div class="k">last check</div>
+            <div class="v">{server.last_checked_at ?? '—'}</div>
         </div>
         <div class="stat">
             <div class="k">held by beta</div>