Add native host management and role-based operator authentication

Introduce an outbound Python host agent, Debian installer, durable remote
operations, immutable game-file libraries, host-aware deployments and ports,
and occupancy-safe campaigns and draining. Native hosts do not require Komodo.

Add administrator, operator and viewer accounts, protected management routes,
secure sessions, password recovery, audit history and separate telemetry tokens.
Document first-admin setup, reporter migration and live-host acceptance checks.

Validation: 1,343 TypeScript tests and 39 agent tests passed, along with type
checking, the production build, compiled SSR/API smoke tests and administrator
recovery. Real Debian/Docker T5/T6 acceptance remains unrun.

svelte.config.js

@@ -10,15 +10,10 @@ const config = {
             $ui: 'src/lib/ui',
             '$ui/*': 'src/lib/ui/*'
         },
-        // Electric Cherry is a private-network fleet manager reached via
-        // whatever hostname/port the operator's proxy exposes it on. Origin
-        // headers get rewritten en route (reverse proxies, LAN IPs, .local
-        // hostnames), so SvelteKit's default cross-site POST guard blocks
-        // legitimate multipart uploads from our own UI. There is no
-        // cross-origin surface to defend against here — the app only accepts
-        // traffic from inside the LAN — so turn the guard off. If this ever
-        // gets exposed to the public internet, add per-route origin checks in
-        // hooks.server.ts instead of re-enabling this blanket rule.
+        // The authentication hook requires exact same-origin browser mutations,
+        // including multipart uploads. Machine routes use their own credentials
+        // and cannot be subjected to the browser-origin rule. Set ORIGIN to the
+        // externally visible HTTPS URL when running behind a reverse proxy.
         csrf: {
             checkOrigin: false
         }