Add native host management and role-based operator authentication

Introduce an outbound Python host agent, Debian installer, durable remote
operations, immutable game-file libraries, host-aware deployments and ports,
and occupancy-safe campaigns and draining. Native hosts do not require Komodo.

Add administrator, operator and viewer accounts, protected management routes,
secure sessions, password recovery, audit history and separate telemetry tokens.
Document first-admin setup, reporter migration and live-host acceptance checks.

Validation: 1,343 TypeScript tests and 39 agent tests passed, along with type
checking, the production build, compiled SSR/API smoke tests and administrator
recovery. Real Debian/Docker T5/T6 acceptance remains unrun.

.env.example

@@ -1,43 +1,33 @@
-# Filesystem paths — inside the Komodo container, these mirror the host layout
-SERVERS_ROOT=/root/zombies/t5
-# T6 is separate; defaults to a sibling t6 directory beside SERVERS_ROOT.
-T6_SERVERS_ROOT=/root/zombies/t6
-REL_DEST=runtime/plutonium/storage/t5/raw/scripts/sp
-# On-disk archive of active beta files (cleared per-beta on promote/rollback)
-BETA_ARCHIVE_DIR=/root/zombies/beta-archive
+# Controller URL: use HTTPS with a trusted certificate for enrolled hosts.
+EC_PUBLIC_URL=https://electric-cherry.example.com
+# Generate separate secrets with: openssl rand -hex 32
+# Setup token authorizes creation of the first administrator only. Remove it
+# after setup. Never reuse the telemetry token as a setup or host credential.
+EC_SETUP_TOKEN=
+# Game reporters send Authorization: Bearer <token> or X-EC-Telemetry-Token.
+# Telemetry ingestion is disabled until a token of at least 32 chars is set.
+EC_TELEMETRY_TOKEN=
+# Persistent SQLite metadata, game-file storage, and beta archives.
+# For an existing deployment, retain its original data directory.
+EC_DATA_DIR=/root/zombies/.electric-cherry
+DB_PATH=./data/cherry.db
+GAME_FILES_ROOT=./data/game-files
+BETA_ARCHIVE_DIR=./data/beta-archive
+BODY_SIZE_LIMIT=Infinity
 
-# SQLite location
-DB_PATH=/data/cherry.db
+# Prepare this runtime from Hosts before deploying. Image and game-file
+# library versions are selected independently in the launch preview.
+PLUTAINER_IMAGE=ghcr.io/ayymoss/plutainer:latest
 
-# Configure campaign retention and restart/startup concurrency in Settings → Fleet settings.
+# Optional shared RCON password. Native instances use independently generated
+# secrets when omitted; RCON packets are sent locally by each host agent.
+# RCON_PASSWORD=
 
-# Komodo
-KOMODO_ADDRESS=https://komodo.example.internal
-KOMODO_API_KEY=
-KOMODO_API_SECRET=
-# Komodo server (host) that new deployments land on. Must match the exact
-# name shown on the Servers page in the Komodo UI. Required to deploy new
-# servers from the Fleet page.
-KOMODO_TARGET_SERVER=
-# Optional overrides for the plutainer defaults used when EC creates a new
-# server. Change these if you fork the image or use a different docker network.
-# PLUTAINER_IMAGE=ghcr.io/ayymoss/plutainer:latest
-# PLUTAINER_NETWORK=komodo_default
-# PLUTAINER_GAMEFILES_VOLUME=t5_game_files
-# PLUTAINER_T6_GAMEFILES_VOLUME=t6_game_files
-# T6_REL_DEST_SCRIPT=runtime/plutonium/storage/t6/scripts/zm
-# T6_CONFIG_TARGET_FILE=dedicated_zm.cfg
-# Port range EC picks from when auto-assigning a game_port to a new server.
-# Must correspond to what's actually forwarded on the Komodo host firewall.
-# SERVER_PORT_MIN=28960
-# SERVER_PORT_MAX=28980
+# Development tests only. Production host transport requires HTTPS.
+# EC_AGENT_ALLOW_HTTP=true
+# Browser login on localhost only (never for an exposed controller):
+# EC_AUTH_ALLOW_HTTP=true
 
-# RCON — shared across the fleet (every server uses the same rcon_password).
-# Host defaults to host.docker.internal so the container can reach game
-# servers on the same Docker host; override if RCON lives elsewhere.
-RCON_PASSWORD=
-RCON_HOST=host.docker.internal
-RCON_TIMEOUT_MS=3000
-
-# HTTP (Komodo API)
-HTTP_TIMEOUT_MS=10000
+# Existing legacy registrations can still use their previous KOMODO_*,
+# SERVERS_ROOT, T6_SERVERS_ROOT, and RCON_HOST settings. Native hosts need none.
+# Fleet concurrency and campaign retention are saved in Settings, not env vars.