feat(auth): add Hive and Google provisioning foundation

[mhmdibrahimm]

What changed

• implements single-use Keychain/HiveAuth-compatible Hive login challenges, compact-signature recovery, and current posting-authority verification
• adds short-lived access/onboarding JWTs, rotating hashed refresh credentials, logout, one-open-session enforcement, and real session-backed Nakama issuance
• exchanges Google authorization-code + PKCE results through Google's maintained library and maps only the verified issuer/subject HMAC (never email)
• adds the permanent-public-record disclosure endpoints and blocks realtime play until the current version is acknowledged
• adds username onboarding plus a durable, retry-safe Google→Hive provisioning coordinator for claim_account/create_claimed_account, initial RC delegation, authority verification, and final identity linking
• adds a provider-neutral non-exportable custody-key contract and player signer adapter; no AWS-specific dependency or raw-key path is introduced
• removes the fixed development realtime principal and upgrades the full API→Nakama smoke test to use a real PostgreSQL-backed session

External production gates

This repository deliberately does not claim that a signup sponsor or production custody provider has been selected. Google→Hive account creation returns a safe unavailable state until approved adapters and policy metadata are configured. Hetzner remains the hosting environment; it is not treated as a custody provider.

Validation

• npm run verify
• npm run realtime:smoke
• 35 API tests plus the existing database, Hive gateway, HAF, Go race, OpenAPI/DBML, clean-migration, and dependency-audit checks

Trello: https://trello.com/c/XtJCtMKg

[mcfarhat]

@mohammadibrahim3 Approved — auth + custodial provisioning. Reviewed + CI green; 102 tests pass. WAX-native, single-use nonce challenge on posting-least-privilege, PKCE Google OIDC with no PII, claimable custodial provisioning behind an isolated no-HTTP-surface signer, fail-closed secrets, idempotent evidence-gated provisioning. Also removes a prior dev auth-bypass. Excellent, security-conscious work. 🎉