Player accounts backend: schema, registration, self-service, SSO provision

- Widen users.role enum to include 'player'; make password_hash nullable;
  add email/email_verified/status/last_login_ip; pin username _ci collation.
- POST /auth/register (honeypot + registerLimiter + botScore, reserved-name
  blocklist, duplicate->409, auto-login). player_registration setting gates it.
- SSO auto-provision in finishLogin (setting-gated); return/portal-aware SSO
  redirects for the player portal; status refusal on login + requireAuth.
- New /player self-service group (account, change username/password, TOTP,
  identities), reusing account.controller; accountChangeLimiter.
- Admin: 'player' role + status/email on user create/update, role/status audit,
  player_registration enum validation, derived public registration flags.
- usernamePolicy module (reserved, sanitize, derive, dedup) + unit tests;
  extend SSO callback tests. 133 server tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/src/model/users/users.db.js

@@ -1,11 +1,22 @@
 const { query } = require('../../utils/db')
 
-const PUBLIC_COLS = 'id, username, role, totp_enabled, created_at, last_login_at'
+const PUBLIC_COLS =
+  'id, username, role, status, email, email_verified, totp_enabled, created_at, last_login_at'
 
-async function insertUser({ username, passwordHash, role = 'admin' }) {
+// passwordHash may be null (SSO-provisioned players who have not set one yet).
+// email/status/emailVerified are optional so existing admin-create callers are
+// unaffected.
+async function insertUser({
+  username,
+  passwordHash = null,
+  role = 'admin',
+  email = null,
+  status = 'active',
+  emailVerified = false,
+}) {
   const res = await query(
-    'INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)',
-    [username, passwordHash, role],
+    'INSERT INTO users (username, password_hash, role, email, status, email_verified) VALUES (?, ?, ?, ?, ?, ?)',
+    [username, passwordHash, role, email, status, emailVerified ? 1 : 0],
   )
   return res.insertId
 }
@@ -50,8 +61,8 @@ async function countAdmins() {
   return Number(rows[0].c)
 }
 
-async function touchLastLogin(id) {
-  return query('UPDATE users SET last_login_at = NOW() WHERE id = ?', [id])
+async function touchLastLogin(id, ip = null) {
+  return query('UPDATE users SET last_login_at = NOW(), last_login_ip = ? WHERE id = ?', [ip, id])
 }
 
 // Move the "tokens valid after" cutoff to now, invalidating every session token
@@ -61,6 +72,16 @@ async function bumpTokensValidAfter(id) {
   return query('UPDATE users SET tokens_valid_after = NOW() WHERE id = ?', [id])
 }
 
+// Set the cutoff to an explicit instant. Used when re-issuing the caller's own
+// session right after a password change: the bump above revokes everything at
+// NOW(), and requireAuth's cutoff test is inclusive (createdAt <= cutoff), so a
+// freshly-minted token sharing that same wall-clock second would be revoked too.
+// Rewinding the cutoff a hair below the new token's issued-at lets it survive
+// while still revoking every older session.
+async function setTokensValidAfter(id, when) {
+  return query('UPDATE users SET tokens_valid_after = ? WHERE id = ?', [when, id])
+}
+
 // Store a (not-yet-enabled) TOTP secret for a user. Enabling is a separate step
 // so a secret is never trusted until the user has confirmed one code.
 async function setTotpSecret(id, secret) {
@@ -86,6 +107,7 @@ module.exports = {
   countAdmins,
   touchLastLogin,
   bumpTokensValidAfter,
+  setTokensValidAfter,
   setTotpSecret,
   enableTotp,
   disableTotp,