refactor(game): lock-free storage, remove /command, flatten engine wrapper

Three-stage refactor of the game-engine plumbing (game logic untouched):

Stage 1 — lock-free persistence + admin serialisation. Remove the file
lock from repo/fs (the .lock file, the Read/Write-vs-*Safe duality and the
dead ReadSafe polling) and replace the two-step rename with a single atomic
rename so concurrent reads are torn-free without a lock. Serialise the
state-mutating admin writers (init/turn/banish) with one shared router
LimitMiddleware, rewritten to block on the request context instead of a
racy shared 100ms timer.

Stage 2 — remove the obsolete immediate-command path end to end. Players
submit through PUT /api/v1/order; the legacy PUT /api/v1/command path is
deleted across game (route, handler, 24 command factories, Ctrl), backend
(Commands handler/route, engineclient.ExecuteCommands), gateway (dispatch +
executeUserGamesCommand + routing entry), the FlatBuffers/model contract
(UserGamesCommand[Response]) and transcoder, plus every affected
OpenAPI/README/FUNCTIONAL/ARCHITECTURE doc. The integration proxy test is
converted to the order path.

Stage 3 — flatten the REST->engine wrapper. Replace the executor adapter,
the controller package functions and RepoController with one concrete
controller.Service; drop the single-implementation Repo and Storage
interfaces (repo.Repo / fs.FS are now concrete). Handlers depend on a thin
handler.Engine seam and own the domain->REST projection; storage is
resolved once at startup instead of per request.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

game/internal/router/handler/order.go

@@ -9,9 +9,11 @@ import (
 	"galaxy/game/internal/repo"
 
 	"github.com/gin-gonic/gin"
+	"github.com/gin-gonic/gin/binding"
+	"github.com/go-playground/validator/v10"
 )
 
-func PutOrderHandler(c *gin.Context, executor CommandExecutor) {
+func PutOrderHandler(c *gin.Context, engine Engine) {
 	var cmd rest.Command
 	if errorResponse(c, c.ShouldBindJSON(&cmd)) {
 		return
@@ -30,7 +32,7 @@ func PutOrderHandler(c *gin.Context, executor CommandExecutor) {
 		commands[i] = command
 	}
 
-	result, err := executor.ValidateOrder(cmd.Actor, commands...)
+	result, err := engine.ValidateOrder(cmd.Actor, commands...)
 	if errorResponse(c, err) {
 		return
 	}
@@ -43,7 +45,7 @@ type orderParam struct {
 	Turn   int    `form:"turn" binding:"gte=0"`
 }
 
-func GetOrderHandler(c *gin.Context, executor CommandExecutor) {
+func GetOrderHandler(c *gin.Context, engine Engine) {
 	p := &orderParam{}
 	// ShouldBindQuery surfaces both validator failures and strconv parse
 	// errors; both are client-side faults, so 400 is the correct mapping.
@@ -52,7 +54,7 @@ func GetOrderHandler(c *gin.Context, executor CommandExecutor) {
 		return
 	}
 
-	o, ok, err := executor.FetchOrder(p.Player, uint(p.Turn))
+	o, ok, err := engine.FetchOrder(p.Player, uint(p.Turn))
 	if errorResponse(c, err) {
 		return
 	}
@@ -64,3 +66,15 @@ func GetOrderHandler(c *gin.Context, executor CommandExecutor) {
 
 	c.JSON(http.StatusOK, o)
 }
+
+// validateCommand runs the gin-registered struct validators against a
+// decoded command. It is the per-command validation hook shared by the
+// order-submission path (PutOrderHandler) and repo.ParseOrder.
+func validateCommand(v order.DecodableCommand) error {
+	if ve, ok := binding.Validator.Engine().(*validator.Validate); ok {
+		if err := ve.Struct(v); err != nil {
+			return err
+		}
+	}
+	return nil
+}