Player accounts frontend + Swagger + schema comment fix

- Player portal: RequirePlayer guard, /account routes (login, register,
  settings) with shared PlayerShell; register reads /public/settings derived
  flags; AuthContext.register; api.register + api.player.* namespace.
- Admin UI: player role + status/email + reset-password hint in UserEditor,
  status column + badge-player in UsersAdmin, player_registration select in
  SettingsAdmin; 'disabled' SSO error copy.
- Swagger: Player tag + RegisterRequest/ChangeUsername/ChangePassword/
  PlayerAccount/OkFlag schemas; regenerated swagger-output.json.
- Fix: remove a semicolon from a schema.sql inline comment that broke the
  statement splitter in ensureSchema.

Verified against the live dev DB: schema migrations apply (player enum,
nullable password_hash, email/status/last_login_ip, seeded setting); 21-check
controller smoke (register gating, dup/reserved, null-hash rules, self change
username/password with session re-issue surviving the cutoff, SSO-only initial
password, banned-login refusal); case-insensitive uniqueness; public settings
expose only derived registration flags. Client builds; 133 server tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/swagger/swagger.js

@@ -47,6 +47,7 @@ const doc = {
     { name: 'Auth · SSO', description: 'OAuth2 / OIDC provider discovery and redirect flow' },
     { name: 'Public', description: 'Unauthenticated site content (settings, posts, wiki, contact)' },
     { name: 'Admin · Account', description: 'Self-service account security (2FA, linked identities)' },
+    { name: 'Player', description: 'Self-service player accounts (register, credentials, 2FA, linked identities)' },
     { name: 'Admin · Dashboard', description: 'Dashboard summary and site mode' },
     { name: 'Admin · Posts', description: 'News / five-on-friday / newsletter / screenshots + uploads' },
     { name: 'Admin · Wiki', description: 'Wiki pages, categories, tags and revisions' },
@@ -113,6 +114,16 @@ const doc = {
           company: { type: 'string', description: 'Honeypot — must be empty for humans.', example: '' },
         },
       },
+      RegisterRequest: {
+        type: 'object',
+        required: ['username', 'password'],
+        properties: {
+          username: { type: 'string', minLength: 3, maxLength: 32, example: 'newplayer' },
+          password: { type: 'string', format: 'password', minLength: 8, maxLength: 64 },
+          email: { type: 'string', format: 'email', nullable: true, example: 'player@example.com' },
+          company: { type: 'string', description: 'Honeypot — must be empty for humans.', example: '' },
+        },
+      },
       LoginResponse: {
         type: 'object',
         description:
@@ -340,7 +351,10 @@ const doc = {
         properties: {
           id: { type: 'integer', example: 1 },
           username: { type: 'string', example: 'admin' },
-          role: { type: 'string', enum: ['admin', 'editor'], example: 'admin' },
+          role: { type: 'string', enum: ['admin', 'editor', 'moderator', 'player'], example: 'admin' },
+          status: { type: 'string', enum: ['active', 'disabled', 'banned', 'pending'], example: 'active' },
+          email: { type: 'string', format: 'email', nullable: true },
+          email_verified: { type: 'boolean', example: false },
           totp_enabled: { type: 'boolean', example: true },
           last_login_at: { type: 'string', format: 'date-time', nullable: true },
           created_at: { type: 'string', format: 'date-time' },
@@ -352,9 +366,53 @@ const doc = {
         properties: {
           username: { type: 'string', minLength: 3, maxLength: 32, example: 'editor1' },
           password: { type: 'string', format: 'password', minLength: 8, maxLength: 64 },
-          role: { type: 'string', enum: ['admin', 'editor'], example: 'editor' },
+          role: { type: 'string', enum: ['admin', 'editor', 'moderator', 'player'], example: 'editor' },
+          status: { type: 'string', enum: ['active', 'disabled', 'banned', 'pending'], example: 'active' },
+          email: { type: 'string', format: 'email', nullable: true },
         },
       },
+      // Player self-service credential changes (/api/v1/player/account/*).
+      ChangeUsernameRequest: {
+        type: 'object',
+        required: ['username'],
+        properties: {
+          username: { type: 'string', minLength: 3, maxLength: 32, example: 'newname' },
+        },
+      },
+      ChangePasswordRequest: {
+        type: 'object',
+        required: ['newPassword'],
+        properties: {
+          newPassword: { type: 'string', format: 'password', minLength: 8, maxLength: 64 },
+          currentPassword: {
+            type: 'string',
+            format: 'password',
+            description:
+              'Required when the account already has a password. Omit only for an SSO-provisioned account setting its first password.',
+          },
+        },
+      },
+      PlayerAccount: {
+        type: 'object',
+        description: 'Self-service player account (GET /player/account).',
+        properties: {
+          id: { type: 'integer', example: 42 },
+          username: { type: 'string', example: 'newplayer' },
+          role: { type: 'string', enum: ['player'], example: 'player' },
+          email: { type: 'string', format: 'email', nullable: true, example: 'player@example.com' },
+          status: { type: 'string', enum: ['active', 'disabled', 'banned', 'pending'], example: 'active' },
+          totp_enabled: { type: 'boolean', example: false },
+          has_password: {
+            type: 'boolean',
+            description: 'False for an SSO-provisioned account that has not set a password yet.',
+            example: true,
+          },
+        },
+      },
+      OkFlag: {
+        type: 'object',
+        properties: { ok: { type: 'boolean', example: true } },
+      },
       TotpCodeRequest: {
         type: 'object',
         required: ['code'],