refactor(api): collapse /admin/account and /player/account onto /auth/me/account

Self-service account security had three URL surfaces onto one controller. All
three mounted the same `admin/account.controller.js` handlers; each of the three
router files carried a header comment apologising for the arrangement.

`/auth/me/account` was already a strict superset, which settles which to keep:

  /admin/account   6 routes  noindex, isLoggedIn, staffOnly
  /player/account  8 routes  noindex, requireAuth
  /auth/me/account 10 routes noindex, requireAuth

Neither of the deleted surfaces carried recovery codes, and /admin/account
carried no username or password change at all — so client.js already called
/auth/me/account/recovery-codes/* for two operations on a screen it otherwise
served from /admin/account. The split was leaking before this change.

Gating is equivalent where it overlapped: /player and /auth/me apply identical
`noindex, requireAuth`, and `staffOnly` on /admin/account was strictly narrower
while buying nothing, since every handler is self-scoped to req.user.id. There
is no CSRF layer to differ.

  - 14 routes deleted, 0 added, no handler changed.
  - account.controller.js moves router/v1/admin/ -> router/v1/auth/, beside the
    one router that still reaches it.
  - Web client: 14 call sites move onto a root-level api.myAccount /
    api.changeUsername / ... group, matching the /auth/me methods already there.
  - Android app: no change. MeApi.kt was already 100% /auth/me/account/*.
  - Two swagger tags, `Admin · Account` and `Player`, were declared only by the
    deleted routes and go with them. The orphaned `AccountStatus` schema goes
    too; `PlayerAccount` is re-described as the any-role /auth/me/account shape
    (the name is kept so existing $refs resolve).

Breaking to the published OpenAPI surface, accepted deliberately: both consumers
are in this org, and deprecate-then-delete would leave the next phase deciding
whether to add routes to surfaces already marked for removal.

Verification: routes.manifest.json shows exactly 14 deletions and 0 additions.
The OpenAPI spec loses the same 14 paths with zero surviving path definitions
changed; its large textual diff is pure reordering, because removing the
first-mounted router shifts every later path. 1203 server tests, 288 client
tests, 53 bot tests green; check:modules, check:hosts and routes:manifest
--check all pass.

Design of record: docs/website/ENGAGEMENT.md Phase 1a. This lands ahead of
engagement Phase 1b, which adds a self-service email field — written once here
rather than three times.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/routes/player/PlayerAccount.jsx

@@ -21,7 +21,7 @@ function ChangeUsername({ account, onChanged }) {
     if (username.trim().length < 3) return setError('Username must be at least 3 characters.')
     setBusy(true)
     try {
-      const { username: next } = await api.player.changeUsername(username.trim())
+      const { username: next } = await api.changeUsername(username.trim())
       setMsg('Username updated.')
       await onChanged(next)
     } catch (err) {
@@ -67,7 +67,7 @@ function ChangePassword({ account }) {
     if (hasPassword && !current) return setError('Enter your current password.')
     setBusy(true)
     try {
-      await api.player.changePassword(next, hasPassword ? current : undefined)
+      await api.changePassword(next, hasPassword ? current : undefined)
       setMsg(hasPassword ? 'Password changed.' : 'Password set. You can now sign in with it.')
       setCurrent('')
       setNext('')
@@ -124,7 +124,7 @@ function TwoFactor({ account, reload }) {
   async function begin() {
     setBusy(true); setMsg(''); setError('')
     try {
-      setSetup(await api.player.totpSetup())
+      setSetup(await api.totpSetup())
       setCode('')
     } catch (err) {
       setError(err.message || 'Could not start setup.')
@@ -135,7 +135,7 @@ function TwoFactor({ account, reload }) {
   async function confirm() {
     setBusy(true); setMsg(''); setError('')
     try {
-      const res = await api.player.totpEnable(code.trim())
+      const res = await api.totpEnable(code.trim())
       setSetup(null); setCode(''); setNewCodes(res?.recoveryCodes || null); setMsg('Two-factor is now enabled.')
       await reload()
     } catch (err) {
@@ -147,7 +147,7 @@ function TwoFactor({ account, reload }) {
   async function disable() {
     setBusy(true); setMsg(''); setError('')
     try {
-      await api.player.totpDisable(code.trim())
+      await api.totpDisable(code.trim())
       setCode(''); setMsg('Two-factor has been disabled.')
       await reload()
     } catch (err) {
@@ -234,7 +234,7 @@ function LinkedAccounts() {
   const load = useCallback(async () => {
     try {
       const [ids, avail] = await Promise.all([
-        api.player.linkedIdentities(),
+        api.myIdentities(),
         api.authProviders().catch(() => []),
       ])
       setLinked(ids)
@@ -251,7 +251,7 @@ function LinkedAccounts() {
   async function unlink(provider) {
     if (!window.confirm(`Unlink ${nameFor(provider)} from your account?`)) return
     try {
-      await api.player.unlinkIdentity(provider)
+      await api.unlinkIdentity(provider)
       await load()
     } catch (err) {
       setError(err.message || 'Could not unlink.')
@@ -397,7 +397,7 @@ export default function PlayerAccount() {
 
   const load = useCallback(async () => {
     try {
-      setAccount(await api.player.getAccount())
+      setAccount(await api.myAccount())
     } catch {
       setError('Could not load your account.')
     } finally {