refactor(api): collapse /admin/account and /player/account onto /auth/me/account

Self-service account security had three URL surfaces onto one controller. All
three mounted the same `admin/account.controller.js` handlers; each of the three
router files carried a header comment apologising for the arrangement.

`/auth/me/account` was already a strict superset, which settles which to keep:

  /admin/account   6 routes  noindex, isLoggedIn, staffOnly
  /player/account  8 routes  noindex, requireAuth
  /auth/me/account 10 routes noindex, requireAuth

Neither of the deleted surfaces carried recovery codes, and /admin/account
carried no username or password change at all — so client.js already called
/auth/me/account/recovery-codes/* for two operations on a screen it otherwise
served from /admin/account. The split was leaking before this change.

Gating is equivalent where it overlapped: /player and /auth/me apply identical
`noindex, requireAuth`, and `staffOnly` on /admin/account was strictly narrower
while buying nothing, since every handler is self-scoped to req.user.id. There
is no CSRF layer to differ.

  - 14 routes deleted, 0 added, no handler changed.
  - account.controller.js moves router/v1/admin/ -> router/v1/auth/, beside the
    one router that still reaches it.
  - Web client: 14 call sites move onto a root-level api.myAccount /
    api.changeUsername / ... group, matching the /auth/me methods already there.
  - Android app: no change. MeApi.kt was already 100% /auth/me/account/*.
  - Two swagger tags, `Admin · Account` and `Player`, were declared only by the
    deleted routes and go with them. The orphaned `AccountStatus` schema goes
    too; `PlayerAccount` is re-described as the any-role /auth/me/account shape
    (the name is kept so existing $refs resolve).

Breaking to the published OpenAPI surface, accepted deliberately: both consumers
are in this org, and deprecate-then-delete would leave the next phase deciding
whether to add routes to surfaces already marked for removal.

Verification: routes.manifest.json shows exactly 14 deletions and 0 additions.
The OpenAPI spec loses the same 14 paths with zero surviving path definitions
changed; its large textual diff is pure reordering, because removing the
first-mounted router shifts every later path. 1203 server tests, 288 client
tests, 53 bot tests green; check:modules, check:hosts and routes:manifest
--check all pass.

Design of record: docs/website/ENGAGEMENT.md Phase 1a. This lands ahead of
engagement Phase 1b, which adds a self-service email field — written once here
rather than three times.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/api/client.js

@@ -105,6 +105,24 @@ export const api = {
   revokeTrustedDevice: (id) =>
     req(`/auth/me/trusted-devices/${encodeURIComponent(id)}`, { method: 'DELETE' }),
   revokeAllTrustedDevices: () => req('/auth/me/trusted-devices', { method: 'DELETE' }),
+  // Self-service account security, role-agnostic under /auth/me/account. This is
+  // the ONLY surface for it: the /admin/account/* and /player/account/* copies
+  // were deleted (both were strictly smaller — neither carried recovery codes),
+  // which is why recovery codes below already lived here while the rest did not.
+  // The change endpoints re-issue the session cookie server-side, so the caller
+  // stays signed in.
+  myAccount: () => req('/auth/me/account'),
+  changeUsername: (username) =>
+    req('/auth/me/account/username', { method: 'PATCH', body: { username } }),
+  changePassword: (newPassword, currentPassword) =>
+    req('/auth/me/account/password', { method: 'PATCH', body: { newPassword, currentPassword } }),
+  totpSetup: () => req('/auth/me/account/totp/setup', { method: 'POST' }),
+  totpEnable: (code) => req('/auth/me/account/totp/enable', { method: 'POST', body: { code } }),
+  totpDisable: (code) => req('/auth/me/account/totp/disable', { method: 'POST', body: { code } }),
+  // Linked SSO identities (self-service). Linking starts at /auth/sso/:id/link.
+  myIdentities: () => req('/auth/me/account/identities'),
+  unlinkIdentity: (provider) =>
+    req(`/auth/me/account/identities/${encodeURIComponent(provider)}`, { method: 'DELETE' }),
   // Recovery (backup) codes. status → remaining count; generate → a fresh set,
   // returned ONCE (password step-up for accounts that have a password).
   recoveryCodesStatus: () => req('/auth/me/account/recovery-codes/status'),
@@ -435,16 +453,6 @@ export const api = {
       req(`/admin/moderation/appeals/${id}/resolve`, { method: 'POST', body: data }),
     getUserAppeals: (discordId) => req(`/admin/moderation/user/${discordId}/appeals`),
 
-    // ----- account security (self-service 2FA) -----
-    getAccount: () => req('/admin/account'),
-    totpSetup: () => req('/admin/account/totp/setup', { method: 'POST' }),
-    totpEnable: (code) => req('/admin/account/totp/enable', { method: 'POST', body: { code } }),
-    totpDisable: (code) => req('/admin/account/totp/disable', { method: 'POST', body: { code } }),
-
-    // ----- linked SSO identities (self-service) -----
-    linkedIdentities: () => req('/admin/account/identities'),
-    unlinkIdentity: (provider) => req(`/admin/account/identities/${provider}`, { method: 'DELETE' }),
-
     // ----- auth providers / SSO config (admin only) -----
     listAuthProviders: () => req('/admin/auth/providers'),
     createAuthProvider: (data) => req('/admin/auth/providers', { method: 'POST', body: data }),
@@ -465,20 +473,9 @@ export const api = {
   },
 
   // ----- player self-service (role: 'player') -----
-  // Mirrors the admin account methods but self-scoped under /player. The change
-  // endpoints re-issue the session cookie server-side, so the caller stays signed in.
+  // Account security is NOT here — it is role-agnostic and lives at the root of
+  // this object, on /auth/me/account. What remains is genuinely player-scoped.
   player: {
-    getAccount: () => req('/player/account'),
-    changeUsername: (username) =>
-      req('/player/account/username', { method: 'PATCH', body: { username } }),
-    changePassword: (newPassword, currentPassword) =>
-      req('/player/account/password', { method: 'PATCH', body: { newPassword, currentPassword } }),
-    totpSetup: () => req('/player/account/totp/setup', { method: 'POST' }),
-    totpEnable: (code) => req('/player/account/totp/enable', { method: 'POST', body: { code } }),
-    totpDisable: (code) => req('/player/account/totp/disable', { method: 'POST', body: { code } }),
-    linkedIdentities: () => req('/player/account/identities'),
-    unlinkIdentity: (provider) => req(`/player/account/identities/${provider}`, { method: 'DELETE' }),
-
     // ----- moderation appeals (self-service) -----
     getMyAppeals: () => req('/player/appeals'),
     getEligibleAppeals: () => req('/player/appeals/eligible'),

client/src/routes/admin/views/AccountAdmin.jsx

@@ -25,7 +25,7 @@ function LinkedAccounts() {
   const load = useCallback(async () => {
     try {
       const [ids, avail] = await Promise.all([
-        api.admin.linkedIdentities(),
+        api.myIdentities(),
         api.authProviders().catch(() => []),
       ])
       setLinked(ids)
@@ -44,7 +44,7 @@ function LinkedAccounts() {
   async function unlink(provider) {
     if (!window.confirm(`Unlink ${nameFor(provider)} from your account?`)) return
     try {
-      await api.admin.unlinkIdentity(provider)
+      await api.unlinkIdentity(provider)
       await load()
     } catch (err) {
       setError(err.message || 'Could not unlink.')
@@ -134,7 +134,7 @@ export default function AccountAdmin() {
 
   async function load() {
     try {
-      setAccount(await api.admin.getAccount())
+      setAccount(await api.myAccount())
     } catch {
       setError('Could not load your account.')
     } finally {
@@ -154,7 +154,7 @@ export default function AccountAdmin() {
     setMsg('')
     setError('')
     try {
-      setSetup(await api.admin.totpSetup())
+      setSetup(await api.totpSetup())
       setCode('')
     } catch (err) {
       setError(err.message || 'Could not start setup.')
@@ -168,7 +168,7 @@ export default function AccountAdmin() {
     setMsg('')
     setError('')
     try {
-      const res = await api.admin.totpEnable(code.trim())
+      const res = await api.totpEnable(code.trim())
       setSetup(null)
       setCode('')
       setNewCodes(res?.recoveryCodes || null)
@@ -186,7 +186,7 @@ export default function AccountAdmin() {
     setMsg('')
     setError('')
     try {
-      await api.admin.totpDisable(code.trim())
+      await api.totpDisable(code.trim())
       setCode('')
       setMsg('Two-factor authentication has been disabled.')
       await load()

client/src/routes/player/PlayerAccount.jsx

@@ -21,7 +21,7 @@ function ChangeUsername({ account, onChanged }) {
     if (username.trim().length < 3) return setError('Username must be at least 3 characters.')
     setBusy(true)
     try {
-      const { username: next } = await api.player.changeUsername(username.trim())
+      const { username: next } = await api.changeUsername(username.trim())
       setMsg('Username updated.')
       await onChanged(next)
     } catch (err) {
@@ -67,7 +67,7 @@ function ChangePassword({ account }) {
     if (hasPassword && !current) return setError('Enter your current password.')
     setBusy(true)
     try {
-      await api.player.changePassword(next, hasPassword ? current : undefined)
+      await api.changePassword(next, hasPassword ? current : undefined)
       setMsg(hasPassword ? 'Password changed.' : 'Password set. You can now sign in with it.')
       setCurrent('')
       setNext('')
@@ -124,7 +124,7 @@ function TwoFactor({ account, reload }) {
   async function begin() {
     setBusy(true); setMsg(''); setError('')
     try {
-      setSetup(await api.player.totpSetup())
+      setSetup(await api.totpSetup())
       setCode('')
     } catch (err) {
       setError(err.message || 'Could not start setup.')
@@ -135,7 +135,7 @@ function TwoFactor({ account, reload }) {
   async function confirm() {
     setBusy(true); setMsg(''); setError('')
     try {
-      const res = await api.player.totpEnable(code.trim())
+      const res = await api.totpEnable(code.trim())
       setSetup(null); setCode(''); setNewCodes(res?.recoveryCodes || null); setMsg('Two-factor is now enabled.')
       await reload()
     } catch (err) {
@@ -147,7 +147,7 @@ function TwoFactor({ account, reload }) {
   async function disable() {
     setBusy(true); setMsg(''); setError('')
     try {
-      await api.player.totpDisable(code.trim())
+      await api.totpDisable(code.trim())
       setCode(''); setMsg('Two-factor has been disabled.')
       await reload()
     } catch (err) {
@@ -234,7 +234,7 @@ function LinkedAccounts() {
   const load = useCallback(async () => {
     try {
       const [ids, avail] = await Promise.all([
-        api.player.linkedIdentities(),
+        api.myIdentities(),
         api.authProviders().catch(() => []),
       ])
       setLinked(ids)
@@ -251,7 +251,7 @@ function LinkedAccounts() {
   async function unlink(provider) {
     if (!window.confirm(`Unlink ${nameFor(provider)} from your account?`)) return
     try {
-      await api.player.unlinkIdentity(provider)
+      await api.unlinkIdentity(provider)
       await load()
     } catch (err) {
       setError(err.message || 'Could not unlink.')
@@ -397,7 +397,7 @@ export default function PlayerAccount() {
 
   const load = useCallback(async () => {
     try {
-      setAccount(await api.player.getAccount())
+      setAccount(await api.myAccount())
     } catch {
       setError('Could not load your account.')
     } finally {