feat(auth): sign in with Steam (MODULE_API 1.17.0)

Steam is a built-in provider beside Google and Discord (STEAM_SIGNIN.md,
D392-D396). OpenID 2.0: the assertion is verified server to server with
check_authentication, return_to must match byte for byte, and the claimed id
must be a 17-digit SteamID64. A Steam Web API key is required to enable it
(D394); persona name and avatar are stored on the identity and refreshed at
each sign-in, and a failed lookup never blocks one. Steam never signs anybody
up (D395), on the web or the mobile bridge. Several Steam accounts may be
linked; DELETE /auth/me/account/identities/:provider takes ?id= to unlink one.

MODULE_API 1.17.0: ctx.identities.list, api.onIdentityLinking (refuse-only,
fails closed, module text never shown) and api.onIdentityLinked. No unlink
hook (D393). Schema additive; OpenAPI, routes and engagement manifests
regenerated with no modules installed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/src/auth/providers/registry.js

@@ -12,6 +12,7 @@
 const GoogleProvider = require('./google.provider')
 const DiscordProvider = require('./discord.provider')
 const GenericOidcProvider = require('./genericOidc.provider')
+const SteamProvider = require('./steam.provider')
 const authProviders = require('../../model/authProviders/authProviders.model')
 
 // kind → provider class.
@@ -20,6 +21,7 @@ const KINDS = {
   discord: DiscordProvider,
   oidc: GenericOidcProvider,
   oauth2: GenericOidcProvider,
+  steam: SteamProvider,
 }
 
 // Built-in providers and their fixed display metadata. Endpoints are in the
@@ -27,6 +29,9 @@ const KINDS = {
 const BUILTINS = [
   { id: 'google', kind: 'google', name: 'Google', priority: 1 },
   { id: 'discord', kind: 'discord', name: 'Discord', priority: 2 },
+  // OpenID 2.0, not OAuth2 (STEAM_SIGNIN.md §3): no client id, and the "secret"
+  // is the Steam Web API key it cannot be enabled without (D394).
+  { id: 'steam', kind: 'steam', name: 'Steam', priority: 3 },
 ]
 
 const BUILTIN_IDS = new Set(BUILTINS.map((b) => b.id))
@@ -35,6 +40,18 @@ function isBuiltin(id) {
   return BUILTIN_IDS.has(id)
 }
 
+// Providers whose callback is OpenID 2.0 (`openid.*` fields) rather than an OAuth2
+// `code`. Steam is the only one, and only as the built-in: a custom provider can
+// only be oidc/oauth2, so the kind is known from the id before any row is read.
+function isOpenId(id) {
+  return id === 'steam'
+}
+
+// Providers that never sign anybody up, whatever player_registration says (D395).
+function neverProvisions(kind) {
+  return kind === 'steam'
+}
+
 // Instantiate a provider from a config row (secret already decrypted by the
 // model as `client_secret`). Returns null for an unknown kind.
 function instantiate(row) {
@@ -66,6 +83,11 @@ async function load(id) {
 // custom (oidc/oauth2) also need the three endpoint URLs. Returns { valid, missing }.
 function validateConfig(row) {
   const missing = []
+  if (row.kind === 'steam') {
+    // No client id; the Web API key is the one thing it needs (D394).
+    if (!row.client_secret_enc && !row.client_secret) missing.push('api_key')
+    return { valid: missing.length === 0, missing }
+  }
   if (!row.client_id) missing.push('client_id')
   // A stored secret shows up as client_secret_enc on plain rows, or client_secret
   // on decrypted rows — accept either as "has a secret".
@@ -110,7 +132,7 @@ async function listEnabledValid() {
     .map((p) => ({
       id: p.id,
       name: p.name,
-      icon: p.kind, // 'google' | 'discord' | 'oidc' | 'oauth2'
+      icon: p.kind, // 'google' | 'discord' | 'steam' | 'oidc' | 'oauth2'
       loginUrl: `/api/v1/auth/sso/${p.id}/start`,
       priority: p.priority ?? 100,
     }))
@@ -120,6 +142,8 @@ module.exports = {
   KINDS,
   BUILTINS,
   isBuiltin,
+  isOpenId,
+  neverProvisions,
   instantiate,
   load,
   validateConfig,