Replace IW4MAdmin with direct RCON for player counts

IW4M kept hitting a network wall (container -> host LAN IP -> IW4M
loopback bind) that we couldn't cleanly punch through, and the two-minute
!rt token added enough operational friction that the pause-all-deployments
gate never got a fair test. RCON gives us the same fact — how many
players are on a server right now — direct from each game server over
UDP, with no session, no token, no proxy.

- Add integrations/rcon.ts: dgram UDP client. rconGetPlayerCount() and
  rconGetStatus() parse both `status` (print + scoreboard) and
  `statusResponse` (info line + rows) dialects. Timeout via
  RCON_TIMEOUT_MS.
- Add komodoResolveGamePort() + extractUdpPort(). Reads Komodo's read
  API for a server, walks both docker-compose-style port objects and
  docker-run-style "host:container/udp" strings, caches into
  servers.game_port on first success.
- Replace pipelineReady() guard in sweep with a simple
  integrations-configured check. Same held/failed/manual outcomes,
  but keyed on RCON+Komodo instead of IW4M+auth-state.
- Worker's status refresh fans out per-server over RCON at concurrency=4
  so a 15-server fleet doesn't spike UDP.
- Schema: drop iw4m_match/iw4m_value, add game_port + rcon_host.
- Delete every auth artifact: TokenModal, auth store, auth-state module,
  /api/auth/token, /api/events/auth, iw4m.test.ts. Layout no longer
  mounts the modal, pipeline store no longer tracks a frozen state.
- README + .env.example + docker-compose.yml + komodo/stack.toml swap
  IW4M_* env for RCON_PASSWORD / RCON_HOST / RCON_TIMEOUT_MS. Same
  host.docker.internal:host-gateway extra_hosts entry, repurposed
  for RCON reach.
- Tests: add rcon.test.ts and komodo.test.ts, update sweep.test.ts to
  drop the auth-freeze case. 23/23 passing.

tests/unit/komodo.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { extractUdpPort } from '../../src/lib/server/integrations/komodo.js';
+
+describe('extractUdpPort', () => {
+    it('returns the published port from docker-compose-style object entries', () => {
+        const payload = {
+            state: {
+                container: {
+                    ports: [
+                        { protocol: 'tcp', published: 3000, target: 3000 },
+                        { protocol: 'udp', published: 4976, target: 28960 }
+                    ]
+                }
+            }
+        };
+        expect(extractUdpPort(payload)).toBe(4976);
+    });
+
+    it('parses docker-run-style "host:container/proto" strings', () => {
+        const payload = { ports: ['3074:3074/tcp', '4977:28960/udp'] };
+        expect(extractUdpPort(payload)).toBe(4977);
+    });
+
+    it('picks the UDP entry even when TCP appears first', () => {
+        const payload = {
+            deeply: {
+                nested: {
+                    ports: [
+                        { Protocol: 'tcp', PublishedPort: 80 },
+                        { Protocol: 'udp', PublishedPort: 5555 }
+                    ]
+                }
+            }
+        };
+        expect(extractUdpPort(payload)).toBe(5555);
+    });
+
+    it('returns null when no UDP mapping exists', () => {
+        const payload = { ports: [{ protocol: 'tcp', published: 3000 }] };
+        expect(extractUdpPort(payload)).toBeNull();
+    });
+
+    it('survives cyclic references', () => {
+        const cyc: Record<string, unknown> = {};
+        cyc.self = cyc;
+        expect(extractUdpPort(cyc)).toBeNull();
+    });
+});