Player accounts backend: schema, registration, self-service, SSO provision

- Widen users.role enum to include 'player'; make password_hash nullable;
  add email/email_verified/status/last_login_ip; pin username _ci collation.
- POST /auth/register (honeypot + registerLimiter + botScore, reserved-name
  blocklist, duplicate->409, auto-login). player_registration setting gates it.
- SSO auto-provision in finishLogin (setting-gated); return/portal-aware SSO
  redirects for the player portal; status refusal on login + requireAuth.
- New /player self-service group (account, change username/password, TOTP,
  identities), reusing account.controller; accountChangeLimiter.
- Admin: 'player' role + status/email on user create/update, role/status audit,
  player_registration enum validation, derived public registration flags.
- usernamePolicy module (reserved, sanitize, derive, dedup) + unit tests;
  extend SSO callback tests. 133 server tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/test/playerAccounts.test.js

@@ -0,0 +1,89 @@
+// Point the DB at a closed port BEFORE requiring anything that builds the pool,
+// so the one branch that reaches the DB fails fast instead of hanging the runner.
+process.env.DB_HOST = '127.0.0.1'
+process.env.DB_PORT = '59999'
+
+const { test, beforeEach, after } = require('node:test')
+const assert = require('node:assert/strict')
+const bcrypt = require('bcryptjs')
+
+const authCtrl = require('../src/router/v1/auth/auth.controller')
+const users = require('../src/model/users/users.model')
+const settings = require('../src/model/settings/settings.model')
+const botScore = require('../src/middleware/botScore')
+const lp = require('../src/middleware/loginProtection')
+const db = require('../src/utils/db')
+
+after(() => db.close())
+
+function mockRes() {
+  return {
+    statusCode: 200,
+    body: null,
+    status(c) {
+      this.statusCode = c
+      return this
+    },
+    json(b) {
+      this.body = b
+      return this
+    },
+    set() {
+      return this
+    },
+    cookie() {
+      return this
+    },
+  }
+}
+
+beforeEach(() => {
+  botScore._reset()
+  lp._reset()
+})
+
+// ── Derived public registration flags ─────────────────────────────────────
+test('registrationFlags maps each mode to password/sso booleans', () => {
+  assert.deepEqual(settings.registrationFlags('disabled'), { password: false, sso: false })
+  assert.deepEqual(settings.registrationFlags('password'), { password: true, sso: false })
+  assert.deepEqual(settings.registrationFlags('sso'), { password: false, sso: true })
+  assert.deepEqual(settings.registrationFlags('both'), { password: true, sso: true })
+})
+
+test('REGISTRATION_MODES is the closed set of allowed values', () => {
+  assert.deepEqual(settings.REGISTRATION_MODES, ['disabled', 'password', 'sso', 'both'])
+})
+
+// ── Null-hash password rule ────────────────────────────────────────────────
+test('validatePassword rejects an SSO-only account with a null hash', async () => {
+  assert.equal(await users.validatePassword({ password_hash: null }, 'anything'), false)
+  assert.equal(await users.validatePassword(null, 'anything'), false)
+})
+
+test('validatePassword accepts a correct password against a real hash', async () => {
+  const password_hash = await bcrypt.hash('correct horse', 10)
+  assert.equal(await users.validatePassword({ password_hash }, 'correct horse'), true)
+  assert.equal(await users.validatePassword({ password_hash }, 'wrong'), false)
+})
+
+test('isDuplicateUsername recognizes the driver duplicate-key error', () => {
+  assert.equal(users.isDuplicateUsername({ code: 'ER_DUP_ENTRY' }), true)
+  assert.equal(users.isDuplicateUsername({ errno: 1062 }), true)
+  assert.equal(users.isDuplicateUsername({ code: 'ER_NO_SUCH_TABLE' }), false)
+  assert.equal(users.isDuplicateUsername(null), false)
+})
+
+// ── Registration honeypot (does not need the DB) ──────────────────────────
+test('register with a filled honeypot fails and bans the IP before any DB hit', async () => {
+  const ip = '203.0.113.90'
+  const req = {
+    ip,
+    body: { username: 'newplayer', password: 'password123', [authCtrl.HONEYPOT_FIELD]: 'Acme' },
+  }
+  const res = mockRes()
+  await authCtrl.register(req, res)
+
+  assert.equal(res.statusCode, 400)
+  assert.doesNotMatch(res.body.message, /honeypot|bot|company/i)
+  assert.equal(botScore.isBanned(ip), true)
+})