feat: production-harden the community alpha match loop

[ovasylenko]

Summary

This PR delivers the community-alpha activation loop and production-hardens the full match path from readiness through native process exit.

• add invite-based two-player rooms, compatibility preflight, synchronized launch barriers, safe native launch grants, evidence collection, and opt-in product telemetry
• add authoritative match-attempt IDs, state deadlines, a replica-safe expiration reconciler, idempotent accept behavior, terminal outcomes, and versioned room-event audit records
• harden relay tickets with signed nonces, single-use replay protection, capability scope, lifetime enforcement, issuance limits, and bounded frame/message/byte budgets
• move API/session ownership into the native boundary and supervise emulator, tunnel, probe, and WebSocket lifecycles with deterministic cleanup
• add strict runtime envelope validation plus explicit retry, error, safe-leave, and reconnect behavior in the client
• canonicalize and cap evidence, protect metrics and decision aggregates with an independent operator credential, and report bounded campaign cohorts plus readiness/launch conversion
• fail closed on weak production secrets, unsafe relay/STUN endpoints, and implicit migrations; Compose now runs migrations as a one-shot dependency
• add real HTTP metrics, structured production logs, backup/restore tooling, an operations runbook, dependency/container security CI, and a signed Windows release workflow with checksums, SBOM, and provenance

Privacy and security

• telemetry remains disabled until explicit player consent and uses a tab-scoped anonymous session ID
• no telemetry user ID, username, ROM/executable path, endpoint, credential, free text, or raw error message is stored
• evidence is decoded into closed Rust types, canonicalized, limited to 64 KiB, membership-checked, and rejected when private fields appear
• Argon2 work runs in bounded blocking workers; production credentials are independently validated and redacted from debug output
• operator aggregates require both an authenticated user session and x-operator-token

Validation

• cargo test --workspace --all-features --locked: 168 Rust tests plus doc tests, including real PostgreSQL migrations/API flows and macOS loopback networking
• desktop backend: format, Clippy, check, and 10 tests
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• pnpm format:check, pnpm typecheck, pnpm test (64 tests), and pnpm build
• generated Rust-to-TypeScript protocol binding drift check
• cargo audit --deny warnings and pnpm audit --prod --audit-level high: no known vulnerabilities
• ShellCheck, Actionlint, git diff --check, and docker compose config --quiet

Local production image execution could not be completed because Docker Desktop's daemon stopped responding before reading either Dockerfile. CI now builds both the server and relay images as a mandatory security job.

Operations and rollout

• required new production variable: OPERATOR_TOKEN (independent value, at least 32 characters)
• required existing production values now fail closed unless relay/STUN endpoints are externally reachable and the relay uses wss://
• migration 008_match_lifecycle.sql must complete before the new server starts; Compose enforces this ordering
• deployment, rollback, backup, restore, monitoring, and incident procedures are documented in docs/operations/RUNBOOK.md

[ovasylenko]

@Zendevve 67