Add native host management and role-based operator authentication

Introduce an outbound Python host agent, Debian installer, durable remote
operations, immutable game-file libraries, host-aware deployments and ports,
and occupancy-safe campaigns and draining. Native hosts do not require Komodo.

Add administrator, operator and viewer accounts, protected management routes,
secure sessions, password recovery, audit history and separate telemetry tokens.
Document first-admin setup, reporter migration and live-host acceptance checks.

Validation: 1,343 TypeScript tests and 39 agent tests passed, along with type
checking, the production build, compiled SSR/API smoke tests and administrator
recovery. Real Debian/Docker T5/T6 acceptance remains unrun.

docker-compose.yml

@@ -7,35 +7,23 @@ services:
     restart: unless-stopped
     ports:
       - "3000:3000"
-    # Lets RCON_HOST=host.docker.internal reach game servers running on the
-    # same Komodo host. Docker Engine 20.10+ resolves this alias when the
-    # extra_hosts entry is present.
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     volumes:
-      # in prod (Komodo host), the game server tree is at /root/zombies
-      - /root/zombies:/root/zombies:rw
-      - /root/zombies/.electric-cherry:/data:rw
+      # Preserve the existing controller database by default. Set EC_DATA_DIR
+      # to a dedicated persistent directory for a new controller installation.
+      - ${EC_DATA_DIR:-/root/zombies/.electric-cherry}:/data:rw
     environment:
-      # SvelteKit's Node adapter caps request bodies at 512KB by default,
-      # which rejects real-world plugin .dll uploads with HTTP 413. Same
-      # trust boundary as the CSRF disable (see svelte.config.js) — this is
-      # LAN-only, so "Infinity" (no cap) is fine. NOTE: "0" does NOT mean
-      # unlimited in this adapter — it blocks anything > 0 bytes. SvelteKit's
-      # own error message calls this out: "To disable body size limits,
-      # specify Infinity rather than 0." If exposed to the public internet,
-      # replace with a concrete byte cap (e.g. "128M") instead.
+      ORIGIN: ${EC_PUBLIC_URL:-http://localhost:3000}
+      EC_SETUP_TOKEN: ${EC_SETUP_TOKEN:-}
+      EC_TELEMETRY_TOKEN: ${EC_TELEMETRY_TOKEN:-}
+      EC_AUTH_ALLOW_HTTP: ${EC_AUTH_ALLOW_HTTP:-false}
+      # Large game files are streamed with manifest size and checksum limits.
       BODY_SIZE_LIMIT: "Infinity"
-      SERVERS_ROOT: /root/zombies/t5
-      T6_SERVERS_ROOT: /root/zombies/t6
-      REL_DEST: runtime/plutonium/storage/t5/raw/scripts/sp
-      BETA_ARCHIVE_DIR: /root/zombies/beta-archive
       DB_PATH: /data/cherry.db
-      KOMODO_ADDRESS: ${KOMODO_ADDRESS}
-      KOMODO_API_KEY: ${KOMODO_API_KEY}
-      KOMODO_API_SECRET: ${KOMODO_API_SECRET}
-      KOMODO_TARGET_SERVER: ${KOMODO_TARGET_SERVER}
-      PLUTAINER_T6_GAMEFILES_VOLUME: ${PLUTAINER_T6_GAMEFILES_VOLUME:-t6_game_files}
-      RCON_PASSWORD: ${RCON_PASSWORD}
-      RCON_HOST: ${RCON_HOST:-host.docker.internal}
-      RCON_TIMEOUT_MS: ${RCON_TIMEOUT_MS:-3000}
+      GAME_FILES_ROOT: /data/game-files
+      BETA_ARCHIVE_DIR: /data/beta-archive
+      # These are logical legacy paths; native instance files live on agents.
+      SERVERS_ROOT: /data/legacy/t5
+      T6_SERVERS_ROOT: /data/legacy/t6
+      PLUTAINER_IMAGE: ${PLUTAINER_IMAGE:-ghcr.io/ayymoss/plutainer:latest}
+      # Optional. Native instances otherwise receive individual random secrets.
+      RCON_PASSWORD: ${RCON_PASSWORD:-}