feat: add authenticated queue recovery

server/domain/queue.go

@@ -139,6 +139,23 @@ func (q *Queue) Cancel(playerID, ticketID, idempotencyKey string, expectedRevisi
 	return ticket, nil
 }
 
+// Get is the recovery read used after a client restart or missed event. It
+// never returns another player's ticket and expires stale queue presence before
+// deciding what the caller may resume.
+func (q *Queue) Get(playerID, ticketID string, now time.Time) (QueueTicket, error) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	q.expireLocked(now)
+	ticket, err := q.ownedTicket(playerID, ticketID)
+	if err != nil {
+		return QueueTicket{}, err
+	}
+	if ticket.State == Expired {
+		return QueueTicket{}, ErrTicketExpired
+	}
+	return ticket, nil
+}
+
 func (q *Queue) Expire(now time.Time) []QueueTicket {
 	q.mu.Lock()
 	defer q.mu.Unlock()