Initial commit — SvelteKit fleet manager for T5 Plutonium servers

Ports push_scripts.sh (1497 lines of bash) to a SvelteKit + SQLite web app
that manages a fleet of T5 Plutonium servers running on Komodo. Same push
and beta workflow as the shell script, with a live SSE pipeline view, a
!rt-token-gated auth modal that hard-pauses deployments on stale tokens,
per-file audit diffs, and a Komodo-container deployment target.

- Push/beta engines port the exact filter, held-by-beta, conflict, and
  stale-backup rules from the shell script
- SQLite (better-sqlite3) replaces script_metadata.json; a one-shot
  importer moves legacy state over on first boot
- 16 vitest tests cover push add/update/skip, beta open→rollback,
  open→promote, conflict guards, sweep frozen/manual branches, and IW4M
  login/status parsing
- docker/ + komodo/stack.toml deploy as a managed container on the same
  host as the game servers, /root/zombies bind-mounted at the same path
  the shell script used

src/routes/api/auth/token/+server.ts

@@ -0,0 +1,30 @@
+import { json } from '@sveltejs/kit';
+import { loginWithToken } from '$lib/server/integrations/iw4m.js';
+import { getAuthState, setAuthState } from '$lib/server/integrations/auth-state.js';
+import { kick } from '$lib/server/pipeline/worker.js';
+
+export async function GET() {
+    return json(getAuthState());
+}
+
+export async function POST({ request }: { request: Request }) {
+    const body = (await request.json().catch(() => ({}))) as { token?: string };
+    const token = (body.token ?? '').trim();
+    if (!/^[a-zA-Z0-9]{4}$/.test(token)) {
+        return json({ ok: false, error: 'token must be exactly 4 alphanumeric characters' }, { status: 400 });
+    }
+    const res = await loginWithToken(token);
+    if (!res.ok) {
+        setAuthState({ kind: 'stale', reason: res.reason === 'rejected' ? 'rejected' : 'unreachable' });
+        return json({ ok: false, error: res.message }, { status: res.reason === 'rejected' ? 401 : 502 });
+    }
+    setAuthState({ kind: 'ready', token, cookie: res.cookie, expiresAt: res.expiresAt });
+    // Fresh cookie → immediately drain any queued restarts.
+    void kick();
+    return json({ ok: true, expiresAt: res.expiresAt });
+}
+
+export async function DELETE() {
+    setAuthState({ kind: 'missing' });
+    return json({ ok: true });
+}