fix(server): enforce durable identity bans on session issuance and auth

banned_until and ban_reason have been in the schema since 0001, but no
production query ever read them -- grepping the tree found no reference
outside the migration itself. The only ban check was an in-memory map on
domain.TicketVerifier used by domain tests. Once real Steam login is
wired, a banned identity would keep full access through every existing
session until expiry and could obtain new ones.

Make the ban part of the durable authentication transaction rather than
a policy each login adapter must remember to re-implement:

- Session issuance inserts only when the identity exists and has no
  active ban, so a banned player cannot mint a session.
- Authentication joins the identity and rejects an active ban on every
  request, so a ban takes effect immediately on every replica rather
  than at session expiry.
- ApplyIdentityBan sets the ban and revokes that identity's sessions in
  one serializable transaction, closing the window where the ban is
  durable but another replica still accepts an issued session.

Bans are time-bounded and clearing one does not resurrect sessions the
ban revoked.

Tests cover enforcement across two independently constructed stores
standing in for two replicas, expiry/unban semantics, and -- separately,
because revocation would otherwise mask it -- that a ban applied without
revoking anything still blocks the next request.

server/domain/auth.go

@@ -152,8 +152,13 @@ func (c *AuthCoordinator) Expire(now time.Time) []AuthAttempt {
 }
 
 var (
-	ErrTicketRejected  = fmt.Errorf("steam ticket rejected")
+	ErrTicketRejected = fmt.Errorf("steam ticket rejected")
+	// ErrSessionRejected is deliberately opaque to the client: it must not
+	// distinguish "no such session" from "wrong token".
 	ErrSessionRejected = fmt.Errorf("session rejected")
+	// ErrIdentityBanned is separate so the server can log and act on a ban
+	// distinctly, even though the client sees the same rejection.
+	ErrIdentityBanned = fmt.Errorf("identity is banned")
 )
 
 func NewTicketVerifier(expectedApp uint64) (*TicketVerifier, error) {