feat: game templates, schemas and validator

Public game templates for GBR Hosting, one games/<id>/game.yaml per game,
imported from the panel. A Go tool validates them against JSON Schemas and
checks for credentials, private addresses and consents that default to
accepted; CI runs it on every push.

Admin/RCON passwords are no longer shared defaults: they are blank with
x-generate so the panel creates one per server, and Palworld/ARK no longer
publish their RCON/REST ports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

schema/game.schema.json

@@ -0,0 +1,79 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.gitea.gbreed.com/gbreed-public/gbr-games/raw/branch/main/schema/game.schema.json",
+  "title": "GBR Hosting game template",
+  "description": "One game.yaml per game. Field names match the control panel's Game entity. Business settings (enabled, paid/private hosting, cover art, pricing tiers) are managed in the panel, not here.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["id", "name", "defaultDockerImage", "installMethod"],
+  "properties": {
+    "id": {
+      "description": "Stable identifier. Must match the folder name. Never rename: servers reference it.",
+      "type": "string",
+      "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
+      "maxLength": 64
+    },
+    "name": { "description": "Display name shown to users.", "type": "string", "minLength": 1 },
+
+    "defaultDockerImage": { "description": "Image the game server runs in.", "type": "string", "minLength": 1 },
+    "defaultStartupCommand": { "description": "Command run inside the container. May use config placeholders.", "type": ["string", "null"] },
+    "requiredMemoryMb": { "type": ["integer", "null"], "minimum": 128 },
+    "requiredDiskMb": { "type": ["integer", "null"], "minimum": 128 },
+    "defaultPorts": {
+      "description": "Ports to expose, e.g. \"25565/tcp\", \"7777/udp\" or \"8211:8211/udp\".",
+      "type": ["array", "null"],
+      "items": { "type": "string", "pattern": "^([0-9]{1,5}:)?[0-9]{1,5}(-[0-9]{1,5})?(/(tcp|udp))?$" }
+    },
+
+    "installMethod": { "enum": ["STEAMCMD", "BASH_SCRIPT", "NONE"] },
+    "installConfig": {
+      "description": "STEAMCMD needs appId; BASH_SCRIPT needs script.",
+      "type": ["object", "null"]
+    },
+
+    "defaultConfig": {
+      "description": "Default values for every server. Users override these per server. Keys may only contain letters, digits, '_', '-' and '.' (the panel drops anything else).",
+      "type": ["object", "null"],
+      "propertyNames": { "pattern": "^[a-zA-Z0-9_.-]+$", "maxLength": 128 }
+    },
+    "configSchema": {
+      "description": "JSON Schema for the settings users can edit. A property with \"x-consent\" (e.g. an EULA) must be explicitly accepted on deploy.",
+      "type": ["object", "null"]
+    },
+    "configFilePath": { "description": "Where defaultConfig + user overrides are written, relative to the server root.", "type": ["string", "null"] },
+    "configFileFormat": {
+      "description": "INI writes key=value lines; STANDARD uses configFormatOptions (header, separator, quoting) for formats like Unreal's OptionSettings=(...).",
+      "enum": ["INI", "STANDARD", "JSON", "ENV", null]
+    },
+    "configFormatOptions": { "type": ["object", "null"] },
+
+    "agnosticCommandConfig": { "description": "How the panel sends console commands (save, broadcast, kick...).", "type": ["object", "null"] },
+    "clusterConfig": { "type": ["object", "null"] },
+
+    "logFilePath": { "type": ["string", "null"] },
+    "backupPaths": { "type": ["array", "null"], "items": { "type": "string" } },
+    "maxBackupSizeMb": { "type": ["integer", "null"], "minimum": 1 },
+
+    "publicIpConfigKey": { "description": "Config key that receives the server's public address.", "type": ["string", "null"] },
+    "maxPlayersConfigKey": { "description": "Config key locked to the pricing tier's player count.", "type": ["string", "null"] },
+    "mapConfigKey": { "type": ["string", "null"] },
+
+    "aiCoverPrompt": { "type": ["string", "null"] }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "installMethod": { "const": "STEAMCMD" } } },
+      "then": {
+        "required": ["installConfig"],
+        "properties": { "installConfig": { "type": "object", "required": ["appId"] } }
+      }
+    },
+    {
+      "if": { "properties": { "installMethod": { "const": "BASH_SCRIPT" } } },
+      "then": {
+        "required": ["installConfig"],
+        "properties": { "installConfig": { "type": "object", "required": ["script"] } }
+      }
+    }
+  ]
+}

schema/test.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.gitea.gbreed.com/gbreed-public/gbr-games/raw/branch/main/schema/test.schema.json",
+  "title": "GBR Hosting game boot-test fixture",
+  "description": "Values CI uses when boot-testing a template. Never put real credentials here: map them to a Gitea Actions secret under 'secrets'.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "config": {
+      "description": "Config values for the test server, layered on top of defaultConfig (e.g. EULA: true).",
+      "type": "object",
+      "propertyNames": { "pattern": "^[a-zA-Z0-9_.-]+$" }
+    },
+    "secrets": {
+      "description": "Config key -> name of a Gitea Actions secret. If a secret is missing, the boot test is skipped, not failed.",
+      "type": "object",
+      "propertyNames": { "pattern": "^[a-zA-Z0-9_.-]+$" },
+      "additionalProperties": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" }
+    },
+    "timeoutSec": {
+      "description": "How long to wait for the server to become ready, including install.",
+      "type": "integer",
+      "minimum": 60,
+      "maximum": 7200
+    }
+  }
+}