feat(auth): wire production Steam sign-in and the client login flow

newAPIService never supplied SteamLogin, so POST /v1/session/steam
always returned 503 auth_unavailable in production. The only
implementation was cmd/testkit-api's fake, which derives an identity
from the ticket string itself and accepts anything -- so the passing
integration path was neither deployable nor secure. On the client side
the game started with an empty token and a loopback base URL, and no
production code called configure() or login_steam(); the menu entered
matchmaking directly, so every request failed ERR_UNAUTHORIZED before
reaching the network.

Add a real ISteamUserAuth/AuthenticateUserTicket adapter behind an
interface, so the production login path is testable with only the Valve
call stubbed. It rejects family-shared copies (the account playing does
not own the app) and, by default, VAC- or publisher-banned accounts, and
refuses malformed tickets locally rather than forwarding them.

Crucially it separates our faults from the player's: a Valve outage or a
revoked publisher key returns 503, not 401. Answering 401 would tell a
legitimate player their login failed and send them to fix an account
that is fine while the real fault went unnoticed. A banned identity now
returns 403 rather than a misleading 503.

Sign-in is configuration-gated on the publisher key and App ID: without
them the endpoint keeps returning 503, since silently accepting an
unverified ticket would be worse than refusing to authenticate. A
returning player keeps the player ID they already had, so ratings,
penalties and bans follow the account rather than the session.

Client side: acquire a web-API ticket through GodotSteam's async
signal -- requesting one returns a handle, not a ticket -- using the
existing dynamic-call pattern so stock Godot still parses the project.
The endpoint is configurable for release builds, and matchmaking
completes sign-in before it will queue.

Verified against real PostgreSQL; 232 Godot tests pass.

Game/scripts/control_plane_client.gd

@@ -15,6 +15,10 @@ signal assignment_connection_started(assignment: AssignmentState)
 signal assignment_connection_failed(detail: String)
 
 const DEFAULT_BASE_URL := "http://127.0.0.1:8080"
+# Release builds must point at the real control plane rather than a developer's
+# loopback. The environment variable is read at startup so the same binary can
+# be pointed at a staging or production endpoint without a rebuild.
+const BASE_URL_ENV := "COSMIC_CLASH_CONTROL_PLANE_URL"
 const PERSIST_PATH := "user://matchmaking_state.cfg"
 const AUTHORITATIVE_RECOVERY_INTERVAL_SECONDS := 5.0
 
@@ -156,6 +160,21 @@ func _connect_when_assigned(match_id: String) -> void:
 		_pending_connect_match_id = match_id
 
 
+# configured_base_url resolves the endpoint this build should use, preferring
+# explicit configuration over the loopback development default.
+static func configured_base_url() -> String:
+	var configured := OS.get_environment(BASE_URL_ENV).strip_edges()
+	if is_valid_base_url(configured):
+		return configured
+	return DEFAULT_BASE_URL
+
+
+# has_session reports whether matchmaking requests can be made at all. Without
+# it every request fails ERR_UNAUTHORIZED at the first guard in _start_request.
+func has_session() -> bool:
+	return not access_token.is_empty() and not is_session_expired(session_expires_at)
+
+
 func configure(url: String, token: String) -> bool:
 	var normalized := url.strip_edges().trim_suffix("/")
 	var normalized_token := token.strip_edges()

Game/scripts/matchmaking.gd

@@ -24,6 +24,7 @@ var _recovery_poll_seconds := 0.0
 var _pending_probe_regions: Array[String] = []
 var _probed_regions: Array[String] = []
 var _deferred_queue := {}
+var _web_api_ticket_handle := 0
 
 
 func _ready() -> void:
@@ -39,10 +40,57 @@ func _ready() -> void:
 	ControlPlaneClient.session_expired.connect(_on_session_expired)
 	ControlPlaneClient.probe_challenge_received.connect(_on_probe_challenge_received)
 	ControlPlaneClient.probe_recorded.connect(_on_probe_recorded)
+	_ensure_signed_in()
 	_refresh_ranked_profile()
 	_render(ControlPlaneClient.state.snapshot())
 
 
+# Matchmaking previously opened with an empty token against a loopback default,
+# so every request failed ERR_UNAUTHORIZED before reaching the network. Point
+# the client at its configured endpoint and complete Steam sign-in first.
+func _ensure_signed_in() -> void:
+	if ControlPlaneClient.has_session():
+		return
+	if not ControlPlaneClient.configure(ControlPlaneClient.configured_base_url(), ""):
+		_on_local_error("Matchmaking endpoint is not configured")
+		return
+	if not SteamBootstrap.supports_web_api_ticket():
+		# Deliberately explicit rather than silently presenting a search that
+		# can never start: online matchmaking requires a verified identity.
+		_on_local_error("Sign-in requires the Steam build: %s" % SteamBootstrap.unavailable_reason())
+		return
+	var steam := Engine.get_singleton("Steam")
+	if not steam.get_auth_ticket_for_web_api.is_connected(_on_web_api_ticket):
+		steam.get_auth_ticket_for_web_api.connect(_on_web_api_ticket)
+	_web_api_ticket_handle = SteamBootstrap.request_web_api_ticket()
+	if _web_api_ticket_handle <= 0:
+		_on_local_error("Could not request a Steam authentication ticket")
+		return
+	ControlPlaneClient.state.set_notice("Signing in...")
+
+
+func _on_web_api_ticket(_handle: int, result: int, ticket: PackedByteArray) -> void:
+	# Steam reports k_EResultOK as 1; anything else means no usable ticket.
+	if result != 1 or ticket.is_empty():
+		_on_local_error("Steam declined to issue an authentication ticket")
+		return
+	var encoded := SteamBootstrap.encode_web_api_ticket(ticket)
+	if encoded.is_empty():
+		_on_local_error("Steam returned an unusable authentication ticket")
+		return
+	var err := ControlPlaneClient.login_steam(encoded)
+	if err != OK:
+		_on_local_error("Could not sign in: %s" % error_string(err))
+
+
+func _exit_tree() -> void:
+	# The ticket handle is a Steam resource; releasing it avoids leaking one
+	# per visit to this screen.
+	if _web_api_ticket_handle > 0:
+		SteamBootstrap.cancel_web_api_ticket(_web_api_ticket_handle)
+		_web_api_ticket_handle = 0
+
+
 func _process(delta: float) -> void:
 	if ControlPlaneClient.state.phase in [MatchmakingState.QUEUED, MatchmakingState.PROPOSED, MatchmakingState.ACCEPTED, MatchmakingState.ALLOCATING]:
 		_elapsed_seconds += delta
@@ -62,6 +110,10 @@ func _process(delta: float) -> void:
 
 
 func _on_queue_pressed() -> void:
+	if not ControlPlaneClient.has_session():
+		# Queueing without a session would fail at the first request guard.
+		_ensure_signed_in()
+		return
 	if ControlPlaneClient.can_retry_queue_create():
 		var retry_err := ControlPlaneClient.retry_queue_create()
 		if retry_err != OK:

Game/scripts/steam_bootstrap.gd

@@ -40,3 +40,53 @@ static func initialize() -> Dictionary:
 	if result is Dictionary and bool(result.get("status", false)):
 		return {"error": OK, "app_id": app_id()}
 	return {"error": ERR_CANT_CONNECT, "reason": "Steam initialization failed for App ID %d" % app_id()}
+
+
+# Web-API auth ticket acquisition (task 7.6). The control plane exchanges this
+# ticket with Valve's publisher API for a verified Steam identity; the client
+# never chooses its own identity, which is what makes this the fix for slot
+# reclaim being keyed on a display name.
+#
+# GodotSteam delivers the ticket asynchronously through the
+# `get_auth_ticket_for_web_api` signal, because the ticket is not usable until
+# Steam has confirmed it with its backend. Requesting one and reading the
+# return value alone yields a handle, not a ticket.
+#
+# Everything here is called dynamically so stock Godot, which has no GodotSteam
+# symbols, can still parse and run the project.
+const WEB_API_IDENTITY := "cosmicclash"
+
+
+static func supports_web_api_ticket() -> bool:
+	if not is_runtime_available():
+		return false
+	var steam := Engine.get_singleton("Steam")
+	return steam.has_signal("get_auth_ticket_for_web_api") and steam.has_method("getAuthTicketForWebApi")
+
+
+# Returns the request handle, or 0 when unavailable. The caller must await the
+# `get_auth_ticket_for_web_api` signal for the ticket itself.
+static func request_web_api_ticket() -> int:
+	if not supports_web_api_ticket():
+		return 0
+	var steam := Engine.get_singleton("Steam")
+	var handle = steam.call("getAuthTicketForWebApi", WEB_API_IDENTITY)
+	return int(handle) if handle is int or handle is float else 0
+
+
+static func cancel_web_api_ticket(handle: int) -> void:
+	if handle <= 0 or not is_runtime_available():
+		return
+	var steam := Engine.get_singleton("Steam")
+	if steam.has_method("cancelAuthTicket"):
+		steam.call("cancelAuthTicket", handle)
+
+
+# GodotSteam hands back raw ticket bytes; the Web API expects them hex encoded.
+static func encode_web_api_ticket(buffer: PackedByteArray) -> String:
+	if buffer.is_empty():
+		return ""
+	var encoded := ""
+	for byte in buffer:
+		encoded += "%02x" % int(byte)
+	return encoded