v5.0.0: protocol v5 and the browser frontend

Protocol v5 replaces newline lines with bounded [u32 len][text] frames and REQ/RES/EVT envelopes. Requests carry correlation ids and the server replays the last 256 replies per connection, so a gateway retry cannot double-debit and a late reply cannot clobber a newer request. HELLO/PONG carry server time; crash rounds announce started_at and push coalesced 10 Hz ticks. Crash now commits sha256(seed) before a round and reveals the seed when it ends, so clients recompute the crash point.

Adds the webd/ gateway: one blocking thread, one ClientCore and one pinned upstream TLS connection per session, an HttpOnly session cookie, takeover, and a 60-second grace window. The browser sends Command JSON and renders View JSON; it never speaks the game protocol or stores credentials.

Adds the vanilla TypeScript browser app at /play/ (login, lobby, all four games, history, notices, crash verification), the nginx /play and /ws routes, and the headless DOM smoke test. webd and the app stay out of the TUI/GUI/server build graph.

The client/server version moves to 5.0.0 in lockstep; v4 peers are refused at HELLO.

1 files changed, 112 insertions, 0 deletions

diff --git a/web/play/index.html b/web/play/index.html
new file mode 100644
index 0000000..e9d4b79
--- /dev/null
+++ b/web/play/index.html
@@ -0,0 +1,112 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Play — żagań.bet</title>
+<meta name="description" content="Play slots, roulette, blackjack and crash with play credits. No real money.">
+<meta name="color-scheme" content="dark">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' ws: wss:; img-src 'self' data:; base-uri 'none'; form-action 'self'">
+<link rel="stylesheet" href="style.css">
+</head>
+<body>
+<div class="shell">
+  <header class="topbar">
+    <a class="brand" href="/">żagań<span>.bet</span></a>
+    <span class="tagline">Play credits · no real money</span>
+    <span class="spacer"></span>
+    <div id="session-bar" class="session" hidden>
+      <span class="who">Signed in as <strong id="account-name"></strong></span>
+      <span id="account-balance" class="balance">— Kr</span>
+      <button id="logout" class="btn ghost small" type="button">Log out</button>
+    </div>
+  </header>
+
+  <main>
+    <section id="auth-screen" hidden>
+      <div class="auth-wrap">
+        <div class="auth-card">
+          <h1>Play żagań.bet</h1>
+          <p class="muted" style="margin: 6px 0 20px">Play-money casino. Your balance is play credit; nothing here is real money.</p>
+          <div class="auth-tabs" role="tablist">
+            <button id="tab-login" class="auth-tab active" type="button" role="tab">Log in</button>
+            <button id="tab-register" class="auth-tab" type="button" role="tab">Register</button>
+          </div>
+          <form id="auth-form">
+            <label class="field">
+              <span class="label">Username</span>
+              <input id="auth-user" class="input" type="text" autocomplete="username" maxlength="32" required>
+            </label>
+            <label class="field">
+              <span class="label">Password</span>
+              <input id="auth-pass" class="input" type="password" autocomplete="current-password" required>
+            </label>
+            <p id="auth-error" class="error-text" style="margin: 0; min-height: 18px"></p>
+            <button id="auth-submit" class="btn primary wide big" type="submit">Log in</button>
+          </form>
+          <p class="auth-foot">Registration gives you 1 000 Kr of play credit. No deposits, no withdrawals, no personal data beyond a username.</p>
+        </div>
+      </div>
+    </section>
+
+    <section id="lobby-screen" hidden>
+      <div class="lobby-head">
+        <div>
+          <h1>Lobby</h1>
+          <p class="muted" style="margin: 4px 0 0">Choose a game. Bets are play credits.</p>
+        </div>
+        <span class="spacer"></span>
+        <button id="show-history" class="btn ghost" type="button">Play history</button>
+        <button id="refresh-lobby" class="btn ghost" type="button">Refresh</button>
+      </div>
+      <div id="game-grid" class="game-grid"></div>
+    </section>
+
+    <section id="game-screen" hidden>
+      <div class="game-head">
+        <button id="leave-game" class="btn ghost" type="button">← Lobby</button>
+        <h1 id="game-title">Game</h1>
+        <span class="spacer"></span>
+        <span id="game-badge" class="label"></span>
+      </div>
+      <div class="game-body">
+        <div id="game-board" class="board"></div>
+        <aside id="game-side" class="sidebar"></aside>
+      </div>
+    </section>
+
+    <section id="history-screen" hidden>
+      <div class="lobby-head">
+        <div>
+          <h1>Play history</h1>
+          <p class="muted" style="margin: 4px 0 0">The last plays on your account.</p>
+        </div>
+        <span class="spacer"></span>
+        <button id="history-back" class="btn ghost" type="button">← Lobby</button>
+      </div>
+      <div id="history-body"></div>
+    </section>
+  </main>
+</div>
+
+<div id="toasts" aria-live="polite"></div>
+
+<div id="replaced-overlay" class="overlay" hidden>
+  <div class="modal">
+    <h2>Opened in another tab</h2>
+    <p>This game was opened somewhere else. Only one tab can play a session at a time.</p>
+    <button id="reload-replaced" class="btn primary" type="button">Reload this tab</button>
+  </div>
+</div>
+
+<div id="reconnect-overlay" class="overlay" hidden>
+  <div class="modal">
+    <h2>Connection lost</h2>
+    <p id="reconnect-message">Trying to reach the game server…</p>
+    <button id="reload-reconnect" class="btn ghost" type="button">Reload</button>
+  </div>
+</div>
+
+<script src="app.js" defer></script>
+</body>
+</html>