docs: complete multiplayer threat model

server/security/test_threat_model.py

@@ -0,0 +1,23 @@
+from pathlib import Path
+import unittest
+
+
+MODEL = (Path(__file__).parents[2] / "docs" / "THREAT-MODEL.md").read_text()
+
+
+class ThreatModelTest(unittest.TestCase):
+    def test_required_threat_classes_have_controls_and_owners(self):
+        for term in (
+            "Forged Steam identity", "Ticket/session replay", "Queue/proposal",
+            "Latency-evidence forgery", "Join-authorisation", "Forged or replayed match result",
+            "Workload/insider compromise", "DDoS", "SDR signing-key theft",
+            "supply chain", "Denial of wallet / autoscaling abuse", "Data loss",
+        ):
+            self.assertIn(term, MODEL)
+        self.assertIn("| Owner |", MODEL)
+        self.assertIn("Residual risk", MODEL)
+        self.assertIn("PostgreSQL is the durable authority", MODEL)
+
+
+if __name__ == "__main__":
+    unittest.main()