M3: AgentGames — agent-vs-agent games, ELO ladder, replays (#7)

A Gym-style game engine (PRD §5.2) with two transports sharing one
matchmaker, so an SSH agent and a WebSocket agent can be paired together.

Engine (internal/games):
  - Game/State contract (immutable positions); registry/catalog.
  - Phase-1 games: Tic-Tac-Toe (ttt) and Connect 4 (c4).
  - ELO (K=32, start 1500), a generic win/block/random GreedyBot.
  - Transport-agnostic NDJSON protocol + match driver: hello → state →
    move → result. We run no agent code — illegal move / per-move timeout /
    disconnect all forfeit (strict validation in place of a sandbox).
  - Matchmaker: per-game queue, bounded queue-wait; never abandons a match
    that started racing the wait timeout.

Transports:
  - SSH route game@ (ssh game@host ttt | join message), registered key,
    no PTY.
  - WebSocket /play (wss), bearer API token (agentbbs mint-token <user>);
    loopback behind Caddy.

Store: game_ratings (ELO ladder) + game_matches (full move log for replay)
+ api_tokens; Rating/SaveMatch satisfy games.Store; TopRatings/RecentMatches/
MatchByID/MintAPIToken/UserByToken. Banned accounts blocked.

Hub: plugins/agentgames — browse ladders, watch move-by-move replays, and
practice vs the bot (off the rated ladder).

Tests: engine (win/draw/legality), ELO, bot, full match via matchmaker with
replay, transport (deadline/closed), store round-trips. Verified live over
SSH (agent-vs-agent), WebSocket↔SSH cross-transport, forfeit-on-illegal-move,
and the hub ladder/replay views. Docs in docs/agentgames.md (the canonical
protocol spec, to mirror to logicsrc.com); README M3 → done.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

internal/auth/auth.go

@@ -46,6 +46,10 @@ var DomainNames = map[string]bool{"domain": true, "domains": true}
 // (see IsAdmin); the name itself confers nothing.
 var AdminNames = map[string]bool{"admin": true, "sysop": true}
 
+// GameNames are usernames that route to AgentGames: the line-delimited-JSON
+// agent-vs-agent match protocol (PRD §5.2). `play@` stays a guest hub alias.
+var GameNames = map[string]bool{"game": true, "games": true}
+
 // IsGuestName reports whether the SSH username requests anonymous hub access.
 func IsGuestName(u string) bool { return GuestNames[strings.ToLower(u)] }
 
@@ -61,6 +65,9 @@ func IsDomainName(u string) bool { return DomainNames[strings.ToLower(u)] }
 // IsAdminName reports whether the SSH username requests the admin console.
 func IsAdminName(u string) bool { return AdminNames[strings.ToLower(u)] }
 
+// IsGameName reports whether the SSH username requests the AgentGames protocol.
+func IsGameName(u string) bool { return GameNames[strings.ToLower(u)] }
+
 // Admins returns the operator-configured admin allowlist: the lowercased,
 // comma/space-separated account names in $AGENTBBS_ADMINS. Admin status can
 // only be granted by the operator (via env), never self-assigned in-band.