refactor(game): lock-free storage, remove /command, flatten engine wrapper

Three-stage refactor of the game-engine plumbing (game logic untouched):

Stage 1 — lock-free persistence + admin serialisation. Remove the file
lock from repo/fs (the .lock file, the Read/Write-vs-*Safe duality and the
dead ReadSafe polling) and replace the two-step rename with a single atomic
rename so concurrent reads are torn-free without a lock. Serialise the
state-mutating admin writers (init/turn/banish) with one shared router
LimitMiddleware, rewritten to block on the request context instead of a
racy shared 100ms timer.

Stage 2 — remove the obsolete immediate-command path end to end. Players
submit through PUT /api/v1/order; the legacy PUT /api/v1/command path is
deleted across game (route, handler, 24 command factories, Ctrl), backend
(Commands handler/route, engineclient.ExecuteCommands), gateway (dispatch +
executeUserGamesCommand + routing entry), the FlatBuffers/model contract
(UserGamesCommand[Response]) and transcoder, plus every affected
OpenAPI/README/FUNCTIONAL/ARCHITECTURE doc. The integration proxy test is
converted to the order path.

Stage 3 — flatten the REST->engine wrapper. Replace the executor adapter,
the controller package functions and RepoController with one concrete
controller.Service; drop the single-implementation Repo and Storage
interfaces (repo.Repo / fs.FS are now concrete). Handlers depend on a thin
handler.Engine seam and own the domain->REST projection; storage is
resolved once at startup instead of per request.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

integration/engine_order_proxy_test.go

@@ -0,0 +1,98 @@
+package integration_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+	"time"
+
+	"galaxy/integration/testenv"
+)
+
+// TestEngineOrderProxy spins up a running game (10 enrolled pilots so
+// engine init succeeds) and verifies that backend's user-side
+// `/api/v1/user/games/{id}/orders` proxy reaches the engine and returns
+// its passthrough body without an internal-error response.
+func TestEngineOrderProxy(t *testing.T) {
+	plat := testenv.Bootstrap(t, testenv.BootstrapOptions{})
+	testenv.EnsureGameImage(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+
+	admin := testenv.NewBackendAdminClient(plat.Backend.HTTPURL, plat.Backend.AdminUser, plat.Backend.AdminPassword)
+	if _, resp, err := admin.Do(ctx, http.MethodPost, "/api/v1/admin/engine-versions", map[string]any{
+		"version": "v1.0.0", "image_ref": testenv.GameImage, "enabled": true,
+	}); err != nil || resp.StatusCode/100 != 2 {
+		t.Fatalf("seed engine_version: err=%v resp=%v", err, resp)
+	}
+
+	owner := testenv.RegisterSession(t, plat, "owner+order@example.com")
+	testenv.PromoteToPaid(t, ctx, admin, plat, owner)
+	ownerID, err := owner.LookupUserID(ctx, plat)
+	if err != nil {
+		t.Fatalf("resolve owner: %v", err)
+	}
+	ownerHTTP := testenv.NewBackendUserClient(plat.Backend.HTTPURL, ownerID)
+
+	gameBody := map[string]any{
+		"game_name":             "Engine Order Proxy",
+		"visibility":            "private",
+		"min_players":           10,
+		"max_players":           10,
+		"start_gap_hours":       1,
+		"start_gap_players":     10,
+		"enrollment_ends_at":    time.Now().Add(24 * time.Hour).UTC().Format(time.RFC3339),
+		"turn_schedule":         "0 * * * *",
+		"target_engine_version": "v1.0.0",
+	}
+	raw, resp, err := ownerHTTP.Do(ctx, http.MethodPost, "/api/v1/user/lobby/games", gameBody)
+	if err != nil || resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create game: err=%v status=%d body=%s", err, resp.StatusCode, string(raw))
+	}
+	var game struct {
+		GameID string `json:"game_id"`
+	}
+	_ = json.Unmarshal(raw, &game)
+
+	if _, resp, err := ownerHTTP.Do(ctx, http.MethodPost, "/api/v1/user/lobby/games/"+game.GameID+"/open-enrollment", nil); err != nil || resp.StatusCode != http.StatusOK {
+		t.Fatalf("open enrollment: %v %d", err, resp.StatusCode)
+	}
+	pilots := testenv.EnrollPilots(t, plat, ownerHTTP, game.GameID, 10, "order")
+
+	if _, resp, err := admin.Do(ctx, http.MethodPost, "/api/v1/admin/games/"+game.GameID+"/force-start", nil); err != nil || resp.StatusCode/100 != 2 {
+		t.Fatalf("force-start: %v %d", err, resp.StatusCode)
+	}
+
+	// Wait until runtime is running.
+	deadline := time.Now().Add(3 * time.Minute)
+	for time.Now().Before(deadline) {
+		raw, resp, err = admin.Do(ctx, http.MethodGet, "/api/v1/admin/runtimes/"+game.GameID, nil)
+		if err == nil && resp.StatusCode == http.StatusOK {
+			var rec struct {
+				Status string `json:"status"`
+			}
+			_ = json.Unmarshal(raw, &rec)
+			if rec.Status == "running" {
+				break
+			}
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+
+	// Pilot 1 submits an (empty) order. Backend forwards to the engine;
+	// the pass-through body comes back unchanged. We accept any status
+	// the engine produces (200, 4xx) — what matters is that backend did
+	// not surface an internal error of its own.
+	orderBody := map[string]any{"cmd": []map[string]any{}}
+	raw, resp, err = pilots[0].HTTP.Do(ctx, http.MethodPost, "/api/v1/user/games/"+game.GameID+"/orders", orderBody)
+	if err != nil {
+		t.Fatalf("orders proxy: %v", err)
+	}
+	if resp.StatusCode == http.StatusInternalServerError || resp.StatusCode == http.StatusBadGateway {
+		t.Fatalf("orders proxy: backend internal-error %d body=%s", resp.StatusCode, string(raw))
+	}
+
+	// Cleanup: stop the container so the test does not leak it.
+	_, _, _ = admin.Do(ctx, http.MethodPost, "/api/v1/admin/games/"+game.GameID+"/force-stop", nil)
+}