refactor(game): lock-free storage, remove /command, flatten engine wrapper

Three-stage refactor of the game-engine plumbing (game logic untouched):

Stage 1 — lock-free persistence + admin serialisation. Remove the file
lock from repo/fs (the .lock file, the Read/Write-vs-*Safe duality and the
dead ReadSafe polling) and replace the two-step rename with a single atomic
rename so concurrent reads are torn-free without a lock. Serialise the
state-mutating admin writers (init/turn/banish) with one shared router
LimitMiddleware, rewritten to block on the request context instead of a
racy shared 100ms timer.

Stage 2 — remove the obsolete immediate-command path end to end. Players
submit through PUT /api/v1/order; the legacy PUT /api/v1/command path is
deleted across game (route, handler, 24 command factories, Ctrl), backend
(Commands handler/route, engineclient.ExecuteCommands), gateway (dispatch +
executeUserGamesCommand + routing entry), the FlatBuffers/model contract
(UserGamesCommand[Response]) and transcoder, plus every affected
OpenAPI/README/FUNCTIONAL/ARCHITECTURE doc. The integration proxy test is
converted to the order path.

Stage 3 — flatten the REST->engine wrapper. Replace the executor adapter,
the controller package functions and RepoController with one concrete
controller.Service; drop the single-implementation Repo and Storage
interfaces (repo.Repo / fs.FS are now concrete). Handlers depend on a thin
handler.Engine seam and own the domain->REST projection; storage is
resolved once at startup instead of per request.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

game/internal/router/middleware.go

@@ -2,27 +2,31 @@ package router
 
 import (
 	"net/http"
-	"time"
 
 	"github.com/gin-gonic/gin"
 )
 
-// LimitMiddleware limits number of concurrent connections using a buffered channel with limit spaces
+// LimitMiddleware caps the number of requests executing the routes it guards
+// at limit. A request blocks until a slot frees up; if the request context is
+// cancelled or expires while waiting, it answers 503 Service Unavailable.
+//
+// The semaphore is owned by the returned handler, so sharing a single instance
+// across several routes serialises those routes against each other. The engine
+// relies on this to serialise every operation that mutates the canonical game
+// state file, which must never run concurrently against one storage directory.
 func LimitMiddleware(limit int) gin.HandlerFunc {
 	if limit <= 0 {
 		panic("limit must be greater than 0")
 	}
-	semaphore := make(chan bool, limit)
-	t := time.NewTimer(time.Millisecond * 100)
+	semaphore := make(chan struct{}, limit)
 
 	return func(c *gin.Context) {
-		t.Reset(time.Millisecond * 100)
 		select {
-		case semaphore <- true:
+		case semaphore <- struct{}{}:
+			defer func() { <-semaphore }()
 			c.Next()
-			<-semaphore
-		case <-t.C:
-			c.Status(http.StatusGatewayTimeout)
+		case <-c.Request.Context().Done():
+			c.AbortWithStatus(http.StatusServiceUnavailable)
 		}
 	}
 }