feat(auth): wire production Steam sign-in and the client login flow

newAPIService never supplied SteamLogin, so POST /v1/session/steam
always returned 503 auth_unavailable in production. The only
implementation was cmd/testkit-api's fake, which derives an identity
from the ticket string itself and accepts anything -- so the passing
integration path was neither deployable nor secure. On the client side
the game started with an empty token and a loopback base URL, and no
production code called configure() or login_steam(); the menu entered
matchmaking directly, so every request failed ERR_UNAUTHORIZED before
reaching the network.

Add a real ISteamUserAuth/AuthenticateUserTicket adapter behind an
interface, so the production login path is testable with only the Valve
call stubbed. It rejects family-shared copies (the account playing does
not own the app) and, by default, VAC- or publisher-banned accounts, and
refuses malformed tickets locally rather than forwarding them.

Crucially it separates our faults from the player's: a Valve outage or a
revoked publisher key returns 503, not 401. Answering 401 would tell a
legitimate player their login failed and send them to fix an account
that is fine while the real fault went unnoticed. A banned identity now
returns 403 rather than a misleading 503.

Sign-in is configuration-gated on the publisher key and App ID: without
them the endpoint keeps returning 503, since silently accepting an
unverified ticket would be worse than refusing to authenticate. A
returning player keeps the player ID they already had, so ratings,
penalties and bans follow the account rather than the session.

Client side: acquire a web-API ticket through GodotSteam's async
signal -- requesting one returns a handle, not a ticket -- using the
existing dynamic-call pattern so stock Godot still parses the project.
The endpoint is configurable for release builds, and matchmaking
completes sign-in before it will queue.

Verified against real PostgreSQL; 232 Godot tests pass.

Game/scripts/control_plane_client.gd

@@ -15,6 +15,10 @@ signal assignment_connection_started(assignment: AssignmentState)
 signal assignment_connection_failed(detail: String)
 
 const DEFAULT_BASE_URL := "http://127.0.0.1:8080"
+# Release builds must point at the real control plane rather than a developer's
+# loopback. The environment variable is read at startup so the same binary can
+# be pointed at a staging or production endpoint without a rebuild.
+const BASE_URL_ENV := "COSMIC_CLASH_CONTROL_PLANE_URL"
 const PERSIST_PATH := "user://matchmaking_state.cfg"
 const AUTHORITATIVE_RECOVERY_INTERVAL_SECONDS := 5.0
 
@@ -156,6 +160,21 @@ func _connect_when_assigned(match_id: String) -> void:
 		_pending_connect_match_id = match_id
 
 
+# configured_base_url resolves the endpoint this build should use, preferring
+# explicit configuration over the loopback development default.
+static func configured_base_url() -> String:
+	var configured := OS.get_environment(BASE_URL_ENV).strip_edges()
+	if is_valid_base_url(configured):
+		return configured
+	return DEFAULT_BASE_URL
+
+
+# has_session reports whether matchmaking requests can be made at all. Without
+# it every request fails ERR_UNAUTHORIZED at the first guard in _start_request.
+func has_session() -> bool:
+	return not access_token.is_empty() and not is_session_expired(session_expires_at)
+
+
 func configure(url: String, token: String) -> bool:
 	var normalized := url.strip_edges().trim_suffix("/")
 	var normalized_token := token.strip_edges()