feat: game templates, schemas and validator

Public game templates for GBR Hosting, one games/<id>/game.yaml per game,
imported from the panel. A Go tool validates them against JSON Schemas and
checks for credentials, private addresses and consents that default to
accepted; CI runs it on every push.

Admin/RCON passwords are no longer shared defaults: they are blank with
x-generate so the panel creates one per server, and Palworld/ARK no longer
publish their RCON/REST ports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

schema/test.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.gitea.gbreed.com/gbreed-public/gbr-games/raw/branch/main/schema/test.schema.json",
+  "title": "GBR Hosting game boot-test fixture",
+  "description": "Values CI uses when boot-testing a template. Never put real credentials here: map them to a Gitea Actions secret under 'secrets'.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "config": {
+      "description": "Config values for the test server, layered on top of defaultConfig (e.g. EULA: true).",
+      "type": "object",
+      "propertyNames": { "pattern": "^[a-zA-Z0-9_.-]+$" }
+    },
+    "secrets": {
+      "description": "Config key -> name of a Gitea Actions secret. If a secret is missing, the boot test is skipped, not failed.",
+      "type": "object",
+      "propertyNames": { "pattern": "^[a-zA-Z0-9_.-]+$" },
+      "additionalProperties": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" }
+    },
+    "timeoutSec": {
+      "description": "How long to wait for the server to become ready, including install.",
+      "type": "integer",
+      "minimum": 60,
+      "maximum": 7200
+    }
+  }
+}