v5.0.0: protocol v5 and the browser frontend

Protocol v5 replaces newline lines with bounded [u32 len][text] frames and REQ/RES/EVT envelopes. Requests carry correlation ids and the server replays the last 256 replies per connection, so a gateway retry cannot double-debit and a late reply cannot clobber a newer request. HELLO/PONG carry server time; crash rounds announce started_at and push coalesced 10 Hz ticks. Crash now commits sha256(seed) before a round and reveals the seed when it ends, so clients recompute the crash point.

Adds the webd/ gateway: one blocking thread, one ClientCore and one pinned upstream TLS connection per session, an HttpOnly session cookie, takeover, and a 60-second grace window. The browser sends Command JSON and renders View JSON; it never speaks the game protocol or stores credentials.

Adds the vanilla TypeScript browser app at /play/ (login, lobby, all four games, history, notices, crash verification), the nginx /play and /ws routes, and the headless DOM smoke test. webd and the app stay out of the TUI/GUI/server build graph.

The client/server version moves to 5.0.0 in lockstep; v4 peers are refused at HELLO.

1 files changed, 15 insertions, 6 deletions

diff --git a/src/client/games/manager.rs b/src/client/games/manager.rs
index 24ceeaa..d35308b 100644
--- a/src/client/games/manager.rs
+++ b/src/client/games/manager.rs
@@ -5,7 +5,7 @@ use super::roulette::RouletteGame;
 use super::slots::SlotsGame;
 use super::traits::{Game, GameError, GamePhase, GameState};
 use crate::blackjack::BlackjackState;
-use crate::crash::{payout, CrashState};
+use crate::crash::{CrashState, payout};
 use crate::roulette::Bets;
 use std::collections::HashMap;
 
@@ -244,9 +244,7 @@ impl GameManager {
 
     pub fn set_roulette_cursor(&mut self, cursor: &crate::client::games::roulette::Cursor) {
         if let Some(session) = self.current_session.as_mut() {
-            session
-                .data
-                .insert("cursor".to_string(), cursor.encoded());
+            session.data.insert("cursor".to_string(), cursor.encoded());
         }
     }
 
@@ -339,7 +337,7 @@ impl GameManager {
         };
         session.bet_amount = state.bet;
         session.data.remove("error");
-        for key in ["crash_point", "payout"] {
+        for key in ["crash_point", "payout", "commit", "seed"] {
             session.data.remove(key);
         }
         session
@@ -360,10 +358,21 @@ impl GameManager {
         session
             .data
             .insert("payout".to_string(), state.payout.to_string());
+        session
+            .data
+            .insert("started_at".to_string(), state.started_at.to_string());
+        if let Some(commit) = &state.commit {
+            session.data.insert("commit".to_string(), commit.clone());
+        }
+        if let Some(seed) = &state.seed {
+            session.data.insert("seed".to_string(), seed.clone());
+        }
         if let Some(crash_point) = state.crash_point {
+            // Keep full precision: the browser recomputes this from the
+            // revealed seed, and the GUI charts it.
             session
                 .data
-                .insert("crash_point".to_string(), format!("{crash_point:.2}"));
+                .insert("crash_point".to_string(), crash_point.to_string());
         }
     }