docs: scope casual and ranked matchmaking as a 1.0 launch blocker

Queued matchmaking had never been considered anywhere in the planning
docs - not as planned work, and not even on the explicitly-deferred
list. It is a launch requirement, so record the design before code.

Add docs/MATCHMAKING.md covering the model change (community-server ->
per-match allocation), the decision to use Steam for identity and a
project-owned backend for queue/rating/allocation, what the existing
server already provides (--max-matches=1 is the allocation primitive,
ServerConfig, the roster, MatchState), the casual/ranked ruleset split,
and the open questions - rating algorithm, team-to-individual rating,
and the server cost that allocated matches reintroduce.

Ranked is hard-blocked on Phase 7 Steam auth tickets: slot reclaim is
keyed by display name today, and a rating on a spoofable identity is
worse than no rating.

Add Phase 8 to multiplayer-next.md, and correct README/CLAUDE.md/
TECH_STACK.md, which asserted no backend exists or is planned - true
before this was scoped, wrong now.

multiplayer-next.md

@@ -28,6 +28,29 @@ implementation evidence, and completed work stay in
 - [ ] Add Steam auth tickets, verified Steam identity in the roster, and a
   persistent ban list. This fixes the slot-reclaim security issue below.
 
+## Phase 8 — casual and ranked matchmaking (1.0 launch blocker)
+
+Design and reasoning: [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md). This is a
+different server model from the community-server one that exists today —
+players queue, a matchmaker groups them, and a server is allocated per match.
+Phase 7's Steam auth tickets are a hard prerequisite: a rating attached to a
+spoofable identity is worse than no rating.
+
+- [ ] Decide the rating algorithm (Glicko-2 recommended over Elo for a small
+  launch population) and how a team result distributes across individuals.
+- [ ] Choose the backend language and hosting, and cost out allocated servers
+  per match at expected population.
+- [ ] Stand up the backend: Steam auth ticket validation via the Steamworks
+  Web API, queue, rating store, server allocator.
+- [ ] Add an assigned-roster server mode so only matched SteamIDs may claim a
+  slot, replacing the first-come model.
+- [ ] Add server-authoritative match result reporting to the backend over a
+  channel a client cannot forge.
+- [ ] Client queue UI: playlist select, estimated wait, accept/decline,
+  connect-on-assignment, post-match rating delta.
+- [ ] Casual and ranked playlist rulesets (backfill, bots, abandon penalties,
+  arena restriction — see the comparison table in the design doc).
+
 ## Known issues to resolve before public hosting
 
 - [ ] Slot reclaim is currently keyed by display name, so someone can take a