Add native host management and role-based operator authentication

Introduce an outbound Python host agent, Debian installer, durable remote
operations, immutable game-file libraries, host-aware deployments and ports,
and occupancy-safe campaigns and draining. Native hosts do not require Komodo.

Add administrator, operator and viewer accounts, protected management routes,
secure sessions, password recovery, audit history and separate telemetry tokens.
Document first-admin setup, reporter migration and live-host acceptance checks.

Validation: 1,343 TypeScript tests and 39 agent tests passed, along with type
checking, the production build, compiled SSR/API smoke tests and administrator
recovery. Real Debian/Docker T5/T6 acceptance remains unrun.

src/lib/server/integrations/rcon.ts

@@ -5,6 +5,7 @@ import { getServer, setServerField } from '../fleet/servers.js';
 import { latestGameSubmission } from '../fleet/lifecycle-evidence.js';
 import { komodoResolveGamePort } from './komodo.js';
 import { parsePlutoniumRevision } from '../../plutonium.js';
+import { nativeInstance, nativeRequest } from '../backends/native.js';
 
 // Plutonium/CoD RCON is UDP with a 4-byte 0xff prefix. Requests look like
 //   \xff\xff\xff\xffrcon <password> <command>
@@ -373,6 +374,26 @@ export function formatRawReply(buf: Buffer): string {
  * rather than just "unreachable".
  */
 export async function rconStatusResult(server: string): Promise<RconStatusResult> {
+    const native = getServer(server)?.native_instance_id ? nativeInstance(server) : null;
+    if (native) {
+        const key = JSON.stringify(['agent', native.id, native.generation, latestGameSubmission(server)]);
+        const existing = statusInFlight.get(key);
+        if (existing) return existing;
+        const endpoint = { host: `agent:${native.host_id}`, port: native.port };
+        const request = (async (): Promise<RconStatusResult> => {
+            try {
+                const reply = await nativeRequest<{ text: string }>(native, 'rcon.execute', { command: 'status' });
+                const players = parsePlayerCount(reply.text);
+                if (players === null) return { ok: false, endpoint, reason: 'bad-reply', detail: 'Agent returned an unrecognized RCON status.', rawReply: reply.text.slice(0, 4000) };
+                const info = parseInfoLine(reply.text); const header = parseStatusHeader(reply.text);
+                return { ok: true, endpoint, status: { players,
+                    capacity: positiveCapacity(info.sv_maxclients ?? header.sv_maxclients),
+                    map: info.mapname ?? info.sv_mapname ?? header.map ?? header.mapname ?? header.sv_mapname ?? null,
+                    gametype: info.g_gametype ?? header.g_gametype ?? header.gametype ?? null, roster: parsePlayerRoster(reply.text) }, rawReply: reply.text.slice(0, 4000) };
+            } catch (error) { return { ok: false, endpoint, reason: 'timeout', detail: (error as Error).message }; }
+        })().finally(() => statusInFlight.delete(key));
+        statusInFlight.set(key, request); return request;
+    }
     // Snapshot before any network work. A probe begun after a restart or a
     // replacement registration must not join one observing the old process.
     const createdAt = getServer(server)?.created_at;
@@ -476,6 +497,14 @@ function positiveCapacity(value: string | undefined): number | null {
 
 /** Query the running process, not the updater's on-disk files. */
 export async function rconPlutoniumVersion(server: string): Promise<{ revision: number | null; error: string | null }> {
+    const native = getServer(server)?.native_instance_id ? nativeInstance(server) : null;
+    if (native) {
+        try {
+            const reply = await nativeRequest<{ text: string }>(native, 'rcon.execute', { command: 'version' });
+            const revision = parsePlutoniumRevision(reply.text);
+            return { revision, error: revision === null ? 'Agent RCON reply did not identify a runtime revision.' : null };
+        } catch (error) { return { revision: null, error: (error as Error).message }; }
+    }
     const { endpoint } = await endpointFor(server);
     if (!endpoint) return { revision: null, error: 'No RCON endpoint available.' };
     const response = await sendRcon(endpoint.host, endpoint.port, 'version');