v5.0.0: protocol v5 and the browser frontend

Protocol v5 replaces newline lines with bounded [u32 len][text] frames and REQ/RES/EVT envelopes. Requests carry correlation ids and the server replays the last 256 replies per connection, so a gateway retry cannot double-debit and a late reply cannot clobber a newer request. HELLO/PONG carry server time; crash rounds announce started_at and push coalesced 10 Hz ticks. Crash now commits sha256(seed) before a round and reveals the seed when it ends, so clients recompute the crash point.

Adds the webd/ gateway: one blocking thread, one ClientCore and one pinned upstream TLS connection per session, an HttpOnly session cookie, takeover, and a 60-second grace window. The browser sends Command JSON and renders View JSON; it never speaks the game protocol or stores credentials.

Adds the vanilla TypeScript browser app at /play/ (login, lobby, all four games, history, notices, crash verification), the nginx /play and /ws routes, and the headless DOM smoke test. webd and the app stay out of the TUI/GUI/server build graph.

The client/server version moves to 5.0.0 in lockstep; v4 peers are refused at HELLO.

1 files changed, 3 insertions, 3 deletions

diff --git a/src/bin/client/connection.rs b/src/bin/client/connection.rs
index f88f62b..e808d90 100644
--- a/src/bin/client/connection.rs
+++ b/src/bin/client/connection.rs
@@ -8,7 +8,7 @@ use parking_lot::Mutex;
 use std::error::Error;
 use zagan_bet::client::transport::{self, TrustPrompt};
 use zagan_bet::client::ui::first_contact_lines;
-use zagan_bet::version::{is_newer, VERSION};
+use zagan_bet::version::{VERSION, is_newer};
 
 pub use zagan_bet::client::transport::TlsStream;
 
@@ -21,7 +21,7 @@ pub fn set_unsafe_mode(unsafe_mode: bool) {
 pub fn connect(
     addr: &str,
     conn: &rusqlite::Connection,
-) -> Result<(TlsStream, Option<String>), Box<dyn Error>> {
+) -> Result<(TlsStream, Option<String>, u64), Box<dyn Error>> {
     let unsafe_mode = *UNSAFE_MODE.lock();
 
     // The terminal has no dialog: print the first-contact notice and trust.
@@ -53,5 +53,5 @@ pub fn connect(
         println!("Authentication failed: {error}");
     }
 
-    Ok((connected.stream, connected.user))
+    Ok((connected.stream, connected.user, connected.server_time))
 }