Player accounts backend: schema, registration, self-service, SSO provision

- Widen users.role enum to include 'player'; make password_hash nullable;
  add email/email_verified/status/last_login_ip; pin username _ci collation.
- POST /auth/register (honeypot + registerLimiter + botScore, reserved-name
  blocklist, duplicate->409, auto-login). player_registration setting gates it.
- SSO auto-provision in finishLogin (setting-gated); return/portal-aware SSO
  redirects for the player portal; status refusal on login + requireAuth.
- New /player self-service group (account, change username/password, TOTP,
  identities), reusing account.controller; accountChangeLimiter.
- Admin: 'player' role + status/email on user create/update, role/status audit,
  player_registration enum validation, derived public registration flags.
- usernamePolicy module (reserved, sanitize, derive, dedup) + unit tests;
  extend SSO callback tests. 133 server tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/src/auth/session.middleware.js

@@ -51,6 +51,13 @@ async function requireAuth(req, res, next) {
     const user = await users.getById(session.userId)
     if (!user) return res.status(401).json({ message: 'Unauthorized' }) // deleted since token issued
 
+    // Status gate, enforced on every request (same immediacy as the cutoff
+    // below): a player disabled/banned by staff loses access on their very next
+    // request, not when their JWT eventually expires.
+    if (user.status && user.status !== 'active') {
+      return res.status(403).json({ message: 'Account disabled' })
+    }
+
     // Revocation, enforced here (not in stateless token verification):
     //   1. per-user cutoff — password change / "log out everywhere" bumps
     //      tokens_valid_after; any token issued before it is dead.