feat(auth): wire production Steam sign-in and the client login flow

newAPIService never supplied SteamLogin, so POST /v1/session/steam
always returned 503 auth_unavailable in production. The only
implementation was cmd/testkit-api's fake, which derives an identity
from the ticket string itself and accepts anything -- so the passing
integration path was neither deployable nor secure. On the client side
the game started with an empty token and a loopback base URL, and no
production code called configure() or login_steam(); the menu entered
matchmaking directly, so every request failed ERR_UNAUTHORIZED before
reaching the network.

Add a real ISteamUserAuth/AuthenticateUserTicket adapter behind an
interface, so the production login path is testable with only the Valve
call stubbed. It rejects family-shared copies (the account playing does
not own the app) and, by default, VAC- or publisher-banned accounts, and
refuses malformed tickets locally rather than forwarding them.

Crucially it separates our faults from the player's: a Valve outage or a
revoked publisher key returns 503, not 401. Answering 401 would tell a
legitimate player their login failed and send them to fix an account
that is fine while the real fault went unnoticed. A banned identity now
returns 403 rather than a misleading 503.

Sign-in is configuration-gated on the publisher key and App ID: without
them the endpoint keeps returning 503, since silently accepting an
unverified ticket would be worse than refusing to authenticate. A
returning player keeps the player ID they already had, so ratings,
penalties and bans follow the account rather than the session.

Client side: acquire a web-API ticket through GodotSteam's async
signal -- requesting one returns a handle, not a ticket -- using the
existing dynamic-call pattern so stock Godot still parses the project.
The endpoint is configurable for release builds, and matchmaking
completes sign-in before it will queue.

Verified against real PostgreSQL; 232 Godot tests pass.

Game/scripts/matchmaking.gd

@@ -24,6 +24,7 @@ var _recovery_poll_seconds := 0.0
 var _pending_probe_regions: Array[String] = []
 var _probed_regions: Array[String] = []
 var _deferred_queue := {}
+var _web_api_ticket_handle := 0
 
 
 func _ready() -> void:
@@ -39,10 +40,57 @@ func _ready() -> void:
 	ControlPlaneClient.session_expired.connect(_on_session_expired)
 	ControlPlaneClient.probe_challenge_received.connect(_on_probe_challenge_received)
 	ControlPlaneClient.probe_recorded.connect(_on_probe_recorded)
+	_ensure_signed_in()
 	_refresh_ranked_profile()
 	_render(ControlPlaneClient.state.snapshot())
 
 
+# Matchmaking previously opened with an empty token against a loopback default,
+# so every request failed ERR_UNAUTHORIZED before reaching the network. Point
+# the client at its configured endpoint and complete Steam sign-in first.
+func _ensure_signed_in() -> void:
+	if ControlPlaneClient.has_session():
+		return
+	if not ControlPlaneClient.configure(ControlPlaneClient.configured_base_url(), ""):
+		_on_local_error("Matchmaking endpoint is not configured")
+		return
+	if not SteamBootstrap.supports_web_api_ticket():
+		# Deliberately explicit rather than silently presenting a search that
+		# can never start: online matchmaking requires a verified identity.
+		_on_local_error("Sign-in requires the Steam build: %s" % SteamBootstrap.unavailable_reason())
+		return
+	var steam := Engine.get_singleton("Steam")
+	if not steam.get_auth_ticket_for_web_api.is_connected(_on_web_api_ticket):
+		steam.get_auth_ticket_for_web_api.connect(_on_web_api_ticket)
+	_web_api_ticket_handle = SteamBootstrap.request_web_api_ticket()
+	if _web_api_ticket_handle <= 0:
+		_on_local_error("Could not request a Steam authentication ticket")
+		return
+	ControlPlaneClient.state.set_notice("Signing in...")
+
+
+func _on_web_api_ticket(_handle: int, result: int, ticket: PackedByteArray) -> void:
+	# Steam reports k_EResultOK as 1; anything else means no usable ticket.
+	if result != 1 or ticket.is_empty():
+		_on_local_error("Steam declined to issue an authentication ticket")
+		return
+	var encoded := SteamBootstrap.encode_web_api_ticket(ticket)
+	if encoded.is_empty():
+		_on_local_error("Steam returned an unusable authentication ticket")
+		return
+	var err := ControlPlaneClient.login_steam(encoded)
+	if err != OK:
+		_on_local_error("Could not sign in: %s" % error_string(err))
+
+
+func _exit_tree() -> void:
+	# The ticket handle is a Steam resource; releasing it avoids leaking one
+	# per visit to this screen.
+	if _web_api_ticket_handle > 0:
+		SteamBootstrap.cancel_web_api_ticket(_web_api_ticket_handle)
+		_web_api_ticket_handle = 0
+
+
 func _process(delta: float) -> void:
 	if ControlPlaneClient.state.phase in [MatchmakingState.QUEUED, MatchmakingState.PROPOSED, MatchmakingState.ACCEPTED, MatchmakingState.ALLOCATING]:
 		_elapsed_seconds += delta
@@ -62,6 +110,10 @@ func _process(delta: float) -> void:
 
 
 func _on_queue_pressed() -> void:
+	if not ControlPlaneClient.has_session():
+		# Queueing without a session would fail at the first request guard.
+		_ensure_signed_in()
+		return
 	if ControlPlaneClient.can_retry_queue_create():
 		var retry_err := ControlPlaneClient.retry_queue_create()
 		if retry_err != OK: