Replace IW4MAdmin with direct RCON for player counts

IW4M kept hitting a network wall (container -> host LAN IP -> IW4M
loopback bind) that we couldn't cleanly punch through, and the two-minute
!rt token added enough operational friction that the pause-all-deployments
gate never got a fair test. RCON gives us the same fact — how many
players are on a server right now — direct from each game server over
UDP, with no session, no token, no proxy.

- Add integrations/rcon.ts: dgram UDP client. rconGetPlayerCount() and
  rconGetStatus() parse both `status` (print + scoreboard) and
  `statusResponse` (info line + rows) dialects. Timeout via
  RCON_TIMEOUT_MS.
- Add komodoResolveGamePort() + extractUdpPort(). Reads Komodo's read
  API for a server, walks both docker-compose-style port objects and
  docker-run-style "host:container/udp" strings, caches into
  servers.game_port on first success.
- Replace pipelineReady() guard in sweep with a simple
  integrations-configured check. Same held/failed/manual outcomes,
  but keyed on RCON+Komodo instead of IW4M+auth-state.
- Worker's status refresh fans out per-server over RCON at concurrency=4
  so a 15-server fleet doesn't spike UDP.
- Schema: drop iw4m_match/iw4m_value, add game_port + rcon_host.
- Delete every auth artifact: TokenModal, auth store, auth-state module,
  /api/auth/token, /api/events/auth, iw4m.test.ts. Layout no longer
  mounts the modal, pipeline store no longer tracks a frozen state.
- README + .env.example + docker-compose.yml + komodo/stack.toml swap
  IW4M_* env for RCON_PASSWORD / RCON_HOST / RCON_TIMEOUT_MS. Same
  host.docker.internal:host-gateway extra_hosts entry, repurposed
  for RCON reach.
- Tests: add rcon.test.ts and komodo.test.ts, update sweep.test.ts to
  drop the auth-freeze case. 23/23 passing.

tests/unit/sweep.test.ts

@@ -8,7 +8,7 @@ beforeEach(async () => {
     fixture = await newFixture({ 'hud.gsc': 'v1' }, ['t5_kino_1', 't5_ascension_1']);
     // No integrations → sweep marks rows manual, exercising that branch.
     delete process.env.KOMODO_ADDRESS;
-    delete process.env.IW4M_ADDRESS;
+    delete process.env.RCON_PASSWORD;
 });
 
 afterEach(async () => {
@@ -20,19 +20,13 @@ describe('sweep', () => {
         const { doPush } = await import('../../src/lib/server/fleet/push.js');
         const { sweep } = await import('../../src/lib/server/pipeline/sweep.js');
         const { seedServerRegistry } = await import('../../src/lib/server/fleet/servers.js');
-        const { setAuthState } = await import('../../src/lib/server/integrations/auth-state.js');
         const { db } = await import('../../src/lib/server/db/index.js');
         await seedServerRegistry();
 
-        // Force ready so pipelineReady() lets sweep run (even though
-        // integrations are off — that's the branch we want to test).
-        setAuthState({ kind: 'ready', token: 'abcd', cookie: 'x=y', expiresAt: Date.now() + 100_000 });
-
         const push = await doPush({ patterns: ['*'] });
         expect(push.deploymentId).not.toBeNull();
 
-        const result = await sweep();
-        expect(result.frozen).toBe(false);
+        await sweep();
 
         const rows = db()
             .prepare("SELECT restart_state FROM deployment_servers WHERE deployment_id = ?")
@@ -40,14 +34,13 @@ describe('sweep', () => {
         for (const r of rows) expect(r.restart_state).toBe('manual');
     });
 
-    it('freezes when auth is not ready', async () => {
-        const { doPush } = await import('../../src/lib/server/fleet/push.js');
+    it('is a no-op when nothing is pending', async () => {
         const { sweep } = await import('../../src/lib/server/pipeline/sweep.js');
         const { seedServerRegistry } = await import('../../src/lib/server/fleet/servers.js');
         await seedServerRegistry();
 
-        await doPush({ patterns: ['*'] });
+        // No deployments → no pending rows. Should return zero counts.
         const result = await sweep();
-        expect(result.frozen).toBe(true);
+        expect(result).toEqual({ checked: 0, restarted: 0, held: 0, failed: 0 });
     });
 });