feat: add BlockCoined guest PvP

[protostatis]

Summary

• sync BlockCoined PvP through upstream commit e6c98a7, including guest matchmaking, rematches, and server-authored cascade presentation
• add a hardened authoritative WebSocket server with transient demo credits, strict origins/protocol validation, bounded clients/challenges, backpressure, and deadline/disconnect forfeits
• wire the game service through Nginx, Compose, CI, and release deployment, and add a small tracked home-page game promotion

Testing

• npm test, npm run lint, and npm run build in dashboard-frontend/game (15 tests)
• npm test and node --check index.js in dashboard-frontend/game/server (46 tests)
• dashboard production build and targeted lint for changed host files
• docker compose config -q and git diff --check
• browser smoke test with two guest clients: lobby challenge, authoritative move/cascade, disconnect forfeit, and home promo

Docker image build was not run locally because Docker Desktop was unavailable; CI builds all four images.

[protostatis]

Sky's Code Review

Adds a production-hardened guest PvP WebSocket server for the BlockCoined game, including lobby matchmaking, authoritative match rooms with deadline forfeits, demo credit ledger, and full CI/deploy integration. The server implementation is thorough with rate limiting, origin validation, graceful shutdown, and good test coverage (46 tests). Docker and deploy changes are well-structured with proper resource limits and healthchecks. Minor issues noted below but nothing blocking.

Verdict: Approve

Comments

• The diff is truncated (14+ files not shown). The Nginx WebSocket proxy config and frontend PvP UI changes are not visible for review. Ensure the Nginx config correctly proxies /game/ws with the Upgrade/Connection headers and appropriate timeouts.
• The deploy script correctly adds the game server to the container count check (4→5), sets proper resource limits (--cpus 0.5 --memory 256m --pids-limit 50), and waits for health before starting the frontend. The comment about Nginx resolving the network alias at startup is a good inclusion.
• Server architecture is solid: versioned protocol handshake, strict message validation, bounded maps/queues, heartbeat ping/pong, graceful SIGTERM/SIGINT handling, and deadline-based forfeits. The 46-test suite covers the full lifecycle including timeouts, disconnections, and edge cases.

---

Reviewed by Sky — Unchained Sky engineering agent

Inline Comments (could not attach to lines)

dashboard-frontend/game/server/Dockerfile:14 — This COPY will include test files (*DemoCreditLedger.test.js, *MatchLobby.test.js, *V2WagerRoom.test.js) in the production image. Consider using a .dockerignore or changing to COPY server/index.js server/DemoCreditLedger.js server/MatchLobby.js server/V2WagerRoom.js ./server/ to keep the image lean.

dashboard-frontend/game/server/Dockerfile:1 — node:20-alpine is not pinned to a patch version. A new 20.x release could change behavior or introduce regressions. Consider pinning to a specific digest or patch version (e.g., node:20.18-alpine) for reproducible builds.

dashboard-frontend/game/server/index.js:225 — The per-IP connection cap trusts X-Real-IP set by Nginx. If the container is ever exposed directly (e.g., in a dev/test environment without Nginx), clients can spoof their IP to bypass the cap. The deploy script correctly keeps it on the internal network, but consider adding a comment or assertion that this must only be accessed through the reverse proxy.