feat(server): complete phase 6 local verification

SERVER.md

@@ -0,0 +1,93 @@
+# Dedicated server
+
+Phase 6 packages a self-hosted ENet server. It does not publish an image or
+binary: build from this checkout and run the generated image locally or on a
+VPS. Direct-IP ENet uses UDP only; the default port is `7777`.
+
+## Local build and verification
+
+Docker is the primary path. It builds the stripped `Linux Dedicated Server`
+export, runs it in one container, joins two independent headless clients from
+two other containers, forces one server-owned goal in each of two matches,
+checks both clients observed both scores and arena rotation, then drains.
+
+```bash
+make verify-phase6
+```
+
+The command prints the temporary log directory even on failure and always
+removes its Compose containers. It neither pushes an image nor uploads an
+artifact. The same command is the only operation in the Phase 6 GitHub Actions
+workflow. Its pinned Godot build image is about 2.4 GB, so leave several GB of
+Docker disk space free for its layers and the exported project.
+
+To build and run a server manually:
+
+```bash
+docker build --target server -t cosmic-clash-server .
+docker run --rm -p 7777:7777/udp cosmic-clash-server \
+  --port=7777 --min-players=2 --start-countdown=5
+```
+
+All server output is structured stdout/stderr. Use Docker's logging driver for
+rotation; for example, configure `json-file` with `max-size` and `max-file` on
+the host. Do not add in-process log rotation.
+
+## Configuration
+
+Every flag is printed by `--help`; unknown flags fail startup. Command-line
+values override a Godot config file's `[server]` values, which override
+defaults. Mount one into the container when needed:
+
+```ini
+[server]
+port=7777
+max-clients=12
+min-players=2
+start-countdown=5
+arena-rotation=sequential
+log-level=info
+```
+
+```bash
+docker run --rm -p 7777:7777/udp \
+  -v "$PWD/server.cfg:/etc/cosmic-clash/server.cfg:ro" \
+  cosmic-clash-server --config=/etc/cosmic-clash/server.cfg
+```
+
+`--max-matches=N` drains only after match `N` ends, then exits `0`; use it for
+planned restarts under a process supervisor. `--smoke-force-goal-after=<seconds>`
+is a documented local-verification switch; its default `-1` disables it, and it
+must not be used for normal matches.
+
+## Native systemd deployment
+
+Copy the exported binary and assets to `/opt/cosmic-clash`, create the
+`cosmicclash` service user, place configuration at
+`/etc/cosmic-clash/server.cfg`, then install
+`deploy/cosmic-clash-server.service` as
+`/etc/systemd/system/cosmic-clash-server.service` and enable it:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable --now cosmic-clash-server
+sudo journalctl -u cosmic-clash-server -f
+```
+
+Godot does not provide a GDScript SIGTERM hook. `systemctl stop`, Ctrl-C, or a
+container stop terminates immediately and connected ENet clients will time out
+after roughly five seconds. Prefer `--max-matches` for planned drains.
+
+## Network and sizing
+
+Open and forward **UDP 7777** (or the configured `--port`) in the host firewall
+and any cloud security group. TCP is not used. The Phase 1 sizing estimate is
+roughly 6–10 simultaneous match processes per modern core, 150–250 MB RSS per
+process, and about 630 kbit/s upstream for a full six-player match; use those
+as a starting point and monitor actual CPU, RSS, and egress.
+
+This build must not be exposed to strangers yet. Slot reclaim is still keyed
+by display name, so a player who knows a disconnected player's name can claim
+their reserved slot. Phase 7 Steam-auth identity is the required fix. Local,
+LAN, and controlled VPS verification are in scope; the public-internet phase
+gate remains blocked on that identity work.