Add native host management and role-based operator authentication

Introduce an outbound Python host agent, Debian installer, durable remote
operations, immutable game-file libraries, host-aware deployments and ports,
and occupancy-safe campaigns and draining. Native hosts do not require Komodo.

Add administrator, operator and viewer accounts, protected management routes,
secure sessions, password recovery, audit history and separate telemetry tokens.
Document first-admin setup, reporter migration and live-host acceptance checks.

Validation: 1,343 TypeScript tests and 39 agent tests passed, along with type
checking, the production build, compiled SSR/API smoke tests and administrator
recovery. Real Debian/Docker T5/T6 acceptance remains unrun.

src/routes/+page.svelte

@@ -31,6 +31,7 @@
     let deployOpen = $state(false);
     let initialGame = $state<ZombieGame>('t5');
     let initialMapSlug = $state('');
+    const canOperate = $derived($page.data.user?.role === 'admin' || $page.data.user?.role === 'operator');
     const filters: { id: FleetFilter; label: string }[] = [
         { id: 'all', label: 'All' }, { id: 'occupied', label: 'Occupied' }, { id: 'empty', label: 'Empty' },
         { id: 'attention', label: 'Needs attention' }, { id: 'testing', label: 'Testing' }, { id: 'pinned', label: 'Pinned' }
@@ -128,10 +129,10 @@
     <SectionHeader title="Fleet" subtitle="Live health, players, and server operations.">
         {#snippet actions()}
             <Button variant="ghost" size="sm" loading={$fleetRefreshing} onclick={() => void refreshFleet()}>Refresh</Button>
-            <Button variant="primary" onclick={() => launch()}>Create server</Button>
+            {#if canOperate}<Button variant="primary" onclick={() => launch()}>Create server</Button>{/if}
         {/snippet}
     </SectionHeader>
-    <DeployServerDialog bind:open={deployOpen} {initialGame} {initialMapSlug} />
+    {#if canOperate}<DeployServerDialog bind:open={deployOpen} {initialGame} {initialMapSlug} />{/if}
 
     {#if $fleetError}
         <div class="error" role="alert"><strong>{$fleet.receivedAt ? 'Showing the last available snapshot.' : 'Fleet is unavailable.'}</strong> {$fleetError}
@@ -148,7 +149,9 @@
             <a class="metric-link" class:no-campaigns={!campaigns} href="/campaigns"><strong>{campaigns}</strong> active campaigns</a>
             <span class="freshness">{$fleetError ? 'Reconnecting' : 'Updated'} · {snapshotAge < 60 ? `${snapshotAge}s` : `${Math.floor(snapshotAge / 60)}m`} ago</span>
         </div>{/if}
-        {#if $fleetIntegrations && (!$fleetIntegrations.komodo || !$fleetIntegrations.rcon)}
+        {#if $fleetIntegrations?.native && !$fleetIntegrations.hostsReady}
+            <div class="setup-note"><span><strong>Prepare a game host</strong> · {$fleetIntegrations.hostsTotal ? 'Hosts are connected or enrolled but need setup before new deployments.' : 'Add a host, prepare its runtime, and download game files.'}</span><a href="/hosts">Review hosts →</a></div>
+        {:else if $page.data.user?.role === 'admin' && $fleetIntegrations && !$fleetIntegrations.native && (!$fleetIntegrations.komodo || !$fleetIntegrations.rcon)}
             <div class="setup-note"><span><strong>Finish system setup</strong> · {!$fleetIntegrations.komodo ? 'Komodo' : ''}{!$fleetIntegrations.komodo && !$fleetIntegrations.rcon ? ' and ' : ''}{!$fleetIntegrations.rcon ? 'RCON' : ''} not configured.</span><a href="/settings">Review setup →</a></div>
         {/if}
 
@@ -176,7 +179,7 @@
         {#if servers.length === 0}
             <EmptyState title="No servers deployed">
                 {#snippet actions()}
-                    <Button variant="primary" onclick={() => launch()}>Create a server</Button>
+                    {#if canOperate}<Button variant="primary" onclick={() => launch()}>Create a server</Button>{/if}
                     <Button href="/collections" variant="ghost">Browse collections</Button>
                 {/snippet}
             </EmptyState>
@@ -205,7 +208,7 @@
             {#each groups as [key, group] (key)}
                 <section class="map-group" aria-label={group.title}>
                     {#if grouping !== 'none'}<div class="group-heading"><div>{#if grouping === 'map'}<span class="eyebrow">{group.game.toUpperCase()}</span>{/if}<h2>{group.title}</h2><p>{group.servers.length} {group.servers.length === 1 ? 'lobby' : 'lobbies'} · {group.servers.some(s => freshServer(s, $uiNow)) ? group.servers.reduce((sum, s) => sum + (freshServer(s, $uiNow) ? s.last_players ?? 0 : 0), 0) : '—'} players · {group.servers.filter(s => freshServer(s, $uiNow) && s.last_players === 0).length} empty</p></div>
-                        {#if group.launch}<Button size="sm" onclick={() => launch(group.launch)}>Add another lobby</Button>{/if}
+                        {#if canOperate && group.launch}<Button size="sm" onclick={() => launch(group.launch)}>Add another lobby</Button>{/if}
                     </div>{/if}
                     {#if view === 'cards'}
                         <div class="cards">{#each group.servers as server (server.name)}