docs: design per-match server autoscaling, with measured boot time

Casual/ranked queues need servers allocated per match and shut down
afterwards, so cost is incurred only while a match runs - while the
existing Docker and CI gates keep passing unchanged.

Measured against the repo's own cosmicclash-server image rather than
estimated: the runtime image is ~148 MB of content, and boot to the
server_started line is ~870 ms on the container's own clock. That was
taken under x86_64 emulation on an arm64 host, so it is a pessimistic
bound and is recorded as one - it needs re-measuring on native Linux
before it sets any timeout.

Two findings that would each break a naive implementation, both hit
while taking that measurement:

- Godot's stdout is block-buffered off a TTY. A detached container logs
  nothing at all - server_started does not appear even after 35s - so an
  orchestrator readiness probe that greps the log hangs forever. Probe
  the UDP socket or flush explicitly.
- --port defaults to 7777 and the Dockerfile hardcodes EXPOSE 7777/udp,
  so several matches cannot share a host without a port range or an
  address per match. Being UDP, L7 ingress routing does not apply.

Also records the honest tension in 'only pay during a match': a server
must listen before players connect, and image pull plus scheduling can
dwarf 870 ms, so the recommendation is match-level scale-to-zero over a
small warm node pool rather than node-level scale-to-zero.

The rule for keeping verify-phase6 and verify-enet-integration green:
every allocation feature is opt-in via a ServerConfig flag defaulting to
current behaviour, with a second Compose file rather than mutating
compose.phase6-smoke.yml.

SERVER.md

@@ -86,6 +86,11 @@ roughly 6–10 simultaneous match processes per modern core, 150–250 MB RSS pe
 process, and about 630 kbit/s upstream for a full six-player match; use those
 as a starting point and monitor actual CPU, RSS, and egress.
 
+Per-match autoscaling — allocating a server for one match and shutting it
+down afterwards — is designed in [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md)
+and not yet implemented. The sizing numbers above predate that work and
+should be re-measured under real concurrency before they size a bill.
+
 This build must not be exposed to strangers yet. Slot reclaim is still keyed
 by display name, so a player who knows a disconnected player's name can claim
 their reserved slot. Phase 7 Steam-auth identity is the required fix. Local,