feat(backend): per-tier, per-kind active-game limits with a guest funnel

Cap a player's simultaneous unfinished games per kind (vs_ai, random,
friends) with independent guest and durable-account tiers, held in a new
single-row backend.config table (-1 = unlimited) behind an in-memory cache
and editable live in the admin console (/_gm/limits). Each game is tagged
with games.game_kind on creation.

This replaces the earlier flat MaxActiveQuickGames=10 combined cap: the
per-tier/kind config is the single mechanism, enforced at the same handler
gate (ensureUnderGameLimit by kind on lobby/enqueue) plus the durable
friends cap in CreateInvitation. game.Service.AtGameLimit only resolves the
tier and counts; the limit policy stays at the request edge.

Guests are now refused friend requests, friend-code redemption,
befriend-in-game and invitation creation outright (403 guest_forbidden) --
previously only the UI hid these.

Admin: a kind column in both game lists and the config editor.

Defaults: guest 1 vs_ai / 1 random / 0 friends; durable 10 / 10 / 10.

backend/internal/postgres/jet/backend/model/config.go

@@ -0,0 +1,18 @@
+//
+// Code generated by go-jet DO NOT EDIT.
+//
+// WARNING: Changes to this file may cause incorrect behavior
+// and will be lost if the code is regenerated
+//
+
+package model
+
+type Config struct {
+	OnlyRow             bool `sql:"primary_key"`
+	GuestVsAiLimit      int16
+	GuestRandomLimit    int16
+	GuestFriendsLimit   int16
+	DurableVsAiLimit    int16
+	DurableRandomLimit  int16
+	DurableFriendsLimit int16
+}

backend/internal/postgres/jet/backend/model/games.go

@@ -33,4 +33,5 @@ type Games struct {
 	DropoutTiles         string
 	MultipleWordsPerTurn bool
 	VsAi                 bool
+	GameKind             int16
 }

backend/internal/postgres/jet/backend/table/config.go

@@ -0,0 +1,96 @@
+//
+// Code generated by go-jet DO NOT EDIT.
+//
+// WARNING: Changes to this file may cause incorrect behavior
+// and will be lost if the code is regenerated
+//
+
+package table
+
+import (
+	"github.com/go-jet/jet/v2/postgres"
+)
+
+var Config = newConfigTable("backend", "config", "")
+
+type configTable struct {
+	postgres.Table
+
+	// Columns
+	OnlyRow             postgres.ColumnBool
+	GuestVsAiLimit      postgres.ColumnInteger
+	GuestRandomLimit    postgres.ColumnInteger
+	GuestFriendsLimit   postgres.ColumnInteger
+	DurableVsAiLimit    postgres.ColumnInteger
+	DurableRandomLimit  postgres.ColumnInteger
+	DurableFriendsLimit postgres.ColumnInteger
+
+	AllColumns     postgres.ColumnList
+	MutableColumns postgres.ColumnList
+	DefaultColumns postgres.ColumnList
+}
+
+type ConfigTable struct {
+	configTable
+
+	EXCLUDED configTable
+}
+
+// AS creates new ConfigTable with assigned alias
+func (a ConfigTable) AS(alias string) *ConfigTable {
+	return newConfigTable(a.SchemaName(), a.TableName(), alias)
+}
+
+// Schema creates new ConfigTable with assigned schema name
+func (a ConfigTable) FromSchema(schemaName string) *ConfigTable {
+	return newConfigTable(schemaName, a.TableName(), a.Alias())
+}
+
+// WithPrefix creates new ConfigTable with assigned table prefix
+func (a ConfigTable) WithPrefix(prefix string) *ConfigTable {
+	return newConfigTable(a.SchemaName(), prefix+a.TableName(), a.TableName())
+}
+
+// WithSuffix creates new ConfigTable with assigned table suffix
+func (a ConfigTable) WithSuffix(suffix string) *ConfigTable {
+	return newConfigTable(a.SchemaName(), a.TableName()+suffix, a.TableName())
+}
+
+func newConfigTable(schemaName, tableName, alias string) *ConfigTable {
+	return &ConfigTable{
+		configTable: newConfigTableImpl(schemaName, tableName, alias),
+		EXCLUDED:    newConfigTableImpl("", "excluded", ""),
+	}
+}
+
+func newConfigTableImpl(schemaName, tableName, alias string) configTable {
+	var (
+		OnlyRowColumn             = postgres.BoolColumn("only_row")
+		GuestVsAiLimitColumn      = postgres.IntegerColumn("guest_vs_ai_limit")
+		GuestRandomLimitColumn    = postgres.IntegerColumn("guest_random_limit")
+		GuestFriendsLimitColumn   = postgres.IntegerColumn("guest_friends_limit")
+		DurableVsAiLimitColumn    = postgres.IntegerColumn("durable_vs_ai_limit")
+		DurableRandomLimitColumn  = postgres.IntegerColumn("durable_random_limit")
+		DurableFriendsLimitColumn = postgres.IntegerColumn("durable_friends_limit")
+		allColumns                = postgres.ColumnList{OnlyRowColumn, GuestVsAiLimitColumn, GuestRandomLimitColumn, GuestFriendsLimitColumn, DurableVsAiLimitColumn, DurableRandomLimitColumn, DurableFriendsLimitColumn}
+		mutableColumns            = postgres.ColumnList{GuestVsAiLimitColumn, GuestRandomLimitColumn, GuestFriendsLimitColumn, DurableVsAiLimitColumn, DurableRandomLimitColumn, DurableFriendsLimitColumn}
+		defaultColumns            = postgres.ColumnList{OnlyRowColumn, GuestVsAiLimitColumn, GuestRandomLimitColumn, GuestFriendsLimitColumn, DurableVsAiLimitColumn, DurableRandomLimitColumn, DurableFriendsLimitColumn}
+	)
+
+	return configTable{
+		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
+
+		//Columns
+		OnlyRow:             OnlyRowColumn,
+		GuestVsAiLimit:      GuestVsAiLimitColumn,
+		GuestRandomLimit:    GuestRandomLimitColumn,
+		GuestFriendsLimit:   GuestFriendsLimitColumn,
+		DurableVsAiLimit:    DurableVsAiLimitColumn,
+		DurableRandomLimit:  DurableRandomLimitColumn,
+		DurableFriendsLimit: DurableFriendsLimitColumn,
+
+		AllColumns:     allColumns,
+		MutableColumns: mutableColumns,
+		DefaultColumns: defaultColumns,
+	}
+}

backend/internal/postgres/jet/backend/table/games.go

@@ -37,6 +37,7 @@ type gamesTable struct {
 	DropoutTiles         postgres.ColumnString
 	MultipleWordsPerTurn postgres.ColumnBool
 	VsAi                 postgres.ColumnBool
+	GameKind             postgres.ColumnInteger
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -98,9 +99,10 @@ func newGamesTableImpl(schemaName, tableName, alias string) gamesTable {
 		DropoutTilesColumn         = postgres.StringColumn("dropout_tiles")
 		MultipleWordsPerTurnColumn = postgres.BoolColumn("multiple_words_per_turn")
 		VsAiColumn                 = postgres.BoolColumn("vs_ai")
-		allColumns                 = postgres.ColumnList{GameIDColumn, VariantColumn, DictVersionColumn, SeedColumn, StatusColumn, PlayersColumn, ToMoveColumn, TurnStartedAtColumn, TurnTimeoutSecsColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, EndReasonColumn, CreatedAtColumn, UpdatedAtColumn, FinishedAtColumn, OpenDeadlineAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn}
-		mutableColumns             = postgres.ColumnList{VariantColumn, DictVersionColumn, SeedColumn, StatusColumn, PlayersColumn, ToMoveColumn, TurnStartedAtColumn, TurnTimeoutSecsColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, EndReasonColumn, CreatedAtColumn, UpdatedAtColumn, FinishedAtColumn, OpenDeadlineAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn}
-		defaultColumns             = postgres.ColumnList{StatusColumn, ToMoveColumn, TurnStartedAtColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, CreatedAtColumn, UpdatedAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn}
+		GameKindColumn             = postgres.IntegerColumn("game_kind")
+		allColumns                 = postgres.ColumnList{GameIDColumn, VariantColumn, DictVersionColumn, SeedColumn, StatusColumn, PlayersColumn, ToMoveColumn, TurnStartedAtColumn, TurnTimeoutSecsColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, EndReasonColumn, CreatedAtColumn, UpdatedAtColumn, FinishedAtColumn, OpenDeadlineAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn, GameKindColumn}
+		mutableColumns             = postgres.ColumnList{VariantColumn, DictVersionColumn, SeedColumn, StatusColumn, PlayersColumn, ToMoveColumn, TurnStartedAtColumn, TurnTimeoutSecsColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, EndReasonColumn, CreatedAtColumn, UpdatedAtColumn, FinishedAtColumn, OpenDeadlineAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn, GameKindColumn}
+		defaultColumns             = postgres.ColumnList{StatusColumn, ToMoveColumn, TurnStartedAtColumn, HintsAllowedColumn, HintsPerPlayerColumn, MoveCountColumn, CreatedAtColumn, UpdatedAtColumn, DropoutTilesColumn, MultipleWordsPerTurnColumn, VsAiColumn, GameKindColumn}
 	)
 
 	return gamesTable{
@@ -127,6 +129,7 @@ func newGamesTableImpl(schemaName, tableName, alias string) gamesTable {
 		DropoutTiles:         DropoutTilesColumn,
 		MultipleWordsPerTurn: MultipleWordsPerTurnColumn,
 		VsAi:                 VsAiColumn,
+		GameKind:             GameKindColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/jet/backend/table/table_use_schema.go

@@ -21,6 +21,7 @@ func UseSchema(schema string) {
 	Blocks = Blocks.FromSchema(schema)
 	ChatMessages = ChatMessages.FromSchema(schema)
 	Complaints = Complaints.FromSchema(schema)
+	Config = Config.FromSchema(schema)
 	DictionaryState = DictionaryState.FromSchema(schema)
 	EmailConfirmations = EmailConfirmations.FromSchema(schema)
 	FeedbackMessages = FeedbackMessages.FromSchema(schema)

backend/internal/postgres/migrations/00014_guest_limits.sql

@@ -0,0 +1,36 @@
+-- Guest-limit foundation (E8): tag each game with its kind so the per-tier, per-kind active-game
+-- limits are enforceable, and add the single-row config that holds those limits (tuned in the admin,
+-- no release). It replaces the old hardcoded MaxActiveQuickGames=10 combined cap with a per-tier,
+-- per-kind config. game_kind: 0=unknown (pre-E8 games, never gated), 1=vs_ai, 2=random, 3=friends —
+-- set on creation. The limits are smallint with -1 = unlimited; a guest defaults to 1 vs_ai + 1
+-- random (friends 0, moot — the guest gate blocks friend games), a durable account to 10 per kind
+-- (the old cap, now per kind). Additive only — applies forward via goose with no data rewrite (no
+-- contour wipe); an image rollback ignores the column + table.
+-- +goose Up
+
+ALTER TABLE backend.games
+    ADD COLUMN game_kind smallint DEFAULT 0 NOT NULL;
+ALTER TABLE backend.games
+    ADD CONSTRAINT games_game_kind_chk CHECK (game_kind >= 0 AND game_kind <= 3);
+
+CREATE TABLE backend.config (
+    only_row boolean DEFAULT true NOT NULL,
+    guest_vs_ai_limit smallint DEFAULT 1 NOT NULL,
+    guest_random_limit smallint DEFAULT 1 NOT NULL,
+    guest_friends_limit smallint DEFAULT 0 NOT NULL,
+    durable_vs_ai_limit smallint DEFAULT 10 NOT NULL,
+    durable_random_limit smallint DEFAULT 10 NOT NULL,
+    durable_friends_limit smallint DEFAULT 10 NOT NULL,
+    CONSTRAINT config_pkey PRIMARY KEY (only_row),
+    CONSTRAINT config_single_row_chk CHECK (only_row),
+    CONSTRAINT config_limits_chk CHECK (
+        guest_vs_ai_limit >= -1 AND guest_random_limit >= -1 AND guest_friends_limit >= -1 AND
+        durable_vs_ai_limit >= -1 AND durable_random_limit >= -1 AND durable_friends_limit >= -1)
+);
+
+INSERT INTO backend.config (only_row) VALUES (true);
+
+-- +goose Down
+
+DROP TABLE backend.config;
+ALTER TABLE backend.games DROP COLUMN game_kind;