Add native host management and role-based operator authentication

Introduce an outbound Python host agent, Debian installer, durable remote
operations, immutable game-file libraries, host-aware deployments and ports,
and occupancy-safe campaigns and draining. Native hosts do not require Komodo.

Add administrator, operator and viewer accounts, protected management routes,
secure sessions, password recovery, audit history and separate telemetry tokens.
Document first-admin setup, reporter migration and live-host acceptance checks.

Validation: 1,343 TypeScript tests and 39 agent tests passed, along with type
checking, the production build, compiled SSR/API smoke tests and administrator
recovery. Real Debian/Docker T5/T6 acceptance remains unrun.

src/lib/server/auth/schema.ts

@@ -0,0 +1,27 @@
+import type Database from 'better-sqlite3';
+const initialized = new WeakSet<Database.Database>();
+export function ensureAuthSchema(handle: Database.Database): void {
+    if (initialized.has(handle)) return;
+    handle.exec(`
+        CREATE TABLE IF NOT EXISTS auth_users (
+            id TEXT PRIMARY KEY, username TEXT NOT NULL COLLATE NOCASE UNIQUE,
+            display_name TEXT NOT NULL, password_hash TEXT NOT NULL,
+            role TEXT NOT NULL CHECK(role IN ('admin','operator','viewer')),
+            disabled INTEGER NOT NULL DEFAULT 0, must_change_password INTEGER NOT NULL DEFAULT 0,
+            created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, last_login_at INTEGER
+        );
+        CREATE TABLE IF NOT EXISTS auth_sessions (
+            token_hash TEXT PRIMARY KEY, user_id TEXT NOT NULL REFERENCES auth_users(id) ON DELETE CASCADE,
+            created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, last_seen_at INTEGER NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS auth_sessions_user ON auth_sessions(user_id);
+        CREATE TABLE IF NOT EXISTS auth_rate_limits (
+            key TEXT PRIMARY KEY, window_start INTEGER NOT NULL, attempts INTEGER NOT NULL
+        );
+        CREATE TABLE IF NOT EXISTS auth_audit (
+            id INTEGER PRIMARY KEY AUTOINCREMENT, actor_id TEXT, action TEXT NOT NULL,
+            target_id TEXT, details TEXT NOT NULL, created_at INTEGER NOT NULL
+        );
+    `);
+    initialized.add(handle);
+}