refactor(game): lock-free storage, remove /command, flatten engine wrapper

Three-stage refactor of the game-engine plumbing (game logic untouched):

Stage 1 — lock-free persistence + admin serialisation. Remove the file
lock from repo/fs (the .lock file, the Read/Write-vs-*Safe duality and the
dead ReadSafe polling) and replace the two-step rename with a single atomic
rename so concurrent reads are torn-free without a lock. Serialise the
state-mutating admin writers (init/turn/banish) with one shared router
LimitMiddleware, rewritten to block on the request context instead of a
racy shared 100ms timer.

Stage 2 — remove the obsolete immediate-command path end to end. Players
submit through PUT /api/v1/order; the legacy PUT /api/v1/command path is
deleted across game (route, handler, 24 command factories, Ctrl), backend
(Commands handler/route, engineclient.ExecuteCommands), gateway (dispatch +
executeUserGamesCommand + routing entry), the FlatBuffers/model contract
(UserGamesCommand[Response]) and transcoder, plus every affected
OpenAPI/README/FUNCTIONAL/ARCHITECTURE doc. The integration proxy test is
converted to the order path.

Stage 3 — flatten the REST->engine wrapper. Replace the executor adapter,
the controller package functions and RepoController with one concrete
controller.Service; drop the single-implementation Repo and Storage
interfaces (repo.Repo / fs.FS are now concrete). Handlers depend on a thin
handler.Engine seam and own the domain->REST projection; storage is
resolved once at startup instead of per request.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

game/internal/repo/repo.go

@@ -1,9 +1,6 @@
 package repo
 
 import (
-	"encoding"
-	"errors"
-
 	e "galaxy/error"
 
 	"galaxy/game/internal/repo/fs"
@@ -25,66 +22,23 @@ func NewStateError(msg string) error {
 	return e.NewGameStateError(msg)
 }
 
-type Storage interface {
-	Lock() (func() error, error)
-	Exists(string) (bool, error)
-	Write(string, encoding.BinaryMarshaler) error
-	WriteSafe(string, encoding.BinaryMarshaler) error
-	Read(string, encoding.BinaryUnmarshaler) error
-	ReadSafe(string, encoding.BinaryUnmarshaler) error
+// Repo persists game state through a file-backed FS. Reads and writes are
+// atomic and lock-free: Write swaps a fully written file into place with
+// rename, so Read never observes a partial file. Serialising concurrent
+// writers to the same state file is the caller's concern (the engine does it
+// at the router, see LimitMiddleware).
+type Repo struct {
+	s *fs.FS
 }
 
-type repo struct {
-	s       Storage
-	release func() error
+func NewRepo(s *fs.FS) (*Repo, error) {
+	return &Repo{s: s}, nil
 }
 
-func NewRepo(s Storage) (*repo, error) {
-	r := &repo{
-		s: s,
-	}
-	return r, nil
-}
-
-func NewFileRepo(path string) (*repo, error) {
+func NewFileRepo(path string) (*Repo, error) {
 	s, err := fs.NewFileStorage(path)
 	if err != nil {
 		return nil, err
 	}
 	return NewRepo(s)
 }
-
-func (r *repo) Lock() (err error) {
-	if r.s == nil {
-		return errors.New("storage is closed")
-	}
-	if r.release != nil {
-		return errors.New("storage already locked")
-	}
-	r.release, err = r.s.Lock()
-	if err != nil {
-		r.close()
-		return
-	}
-	return nil
-}
-
-func (r *repo) Release() (err error) {
-	if r.s == nil {
-		return errors.New("storage is closed")
-	}
-	if r.release == nil {
-		return errors.New("storage was never locked")
-	}
-	err = r.release()
-	if err != nil {
-		return
-	}
-	r.close()
-	return nil
-}
-
-func (r *repo) close() {
-	r.release = nil
-	r.s = nil
-}