feat: add authenticated supervisor drain

server/supervisor/supervisor.go

@@ -31,6 +31,8 @@ type Config struct {
 	SDKBaseURL   string
 	ReadyURL     string
 	Transport    string
+	DrainURL     string
+	DrainToken   string
 	ReadyTimeout time.Duration
 	PollInterval time.Duration
 	HTTPClient   *http.Client
@@ -115,6 +117,29 @@ func (s *Supervisor) Wait() error {
 	return s.cmd.Wait()
 }
 
+// Drain asks the allocated Godot process to stop accepting new work. The
+// token is sent only over the configured localhost control endpoint and is
+// never placed in command arguments or logs.
+func (s *Supervisor) Drain(ctx context.Context) error {
+	if s.config.DrainURL == "" || s.config.DrainToken == "" {
+		return fmt.Errorf("authenticated drain endpoint is required")
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, s.config.DrainURL, nil)
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Authorization", "Bearer "+s.config.DrainToken)
+	response, err := s.client.Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode/100 != 2 {
+		return fmt.Errorf("drain endpoint returned %s", response.Status)
+	}
+	return nil
+}
+
 func (s *Supervisor) assignedEndpoint(ctx context.Context) (int, string, error) {
 	var server GameServer
 	if err := s.sdkGet(ctx, "/gameserver", &server); err != nil {