web: accept the serialized reels array and stop game loops on navigation

The Rust SlotsView serializes reels as an array of chars, so the browser joins it instead of String(array). The crash chart, reel animation and roulette observer now stop when another screen takes over, and a returning crash screen rebuilds its detached canvas. Action buttons ignore a double click before the server view arrives.

Also tightens the gateway session registry with a generation token, caps WebSocket messages at 64 KiB, uses the __Host- cookie prefix on HTTPS, and ships the systemd unit.

1 files changed, 13 insertions, 1 deletions

diff --git a/web/play/src/crash.ts b/web/play/src/crash.ts
index 6f3c8dd..a683dcd 100644
--- a/web/play/src/crash.ts
+++ b/web/play/src/crash.ts
@@ -31,6 +31,7 @@ let sendCommand: ((command: unknown) => void) | null = null;
 let frameHandle: number | undefined;
 let verifyToken = 0;
 let lastStatus = "";
+let lastAction = 0;
 
 function build(
   board: HTMLElement,
@@ -88,6 +89,8 @@ function build(
   const primary = node("button", "btn primary wide big", "START") as HTMLButtonElement;
   const leave = node("button", "btn ghost wide", "Leave table") as HTMLButtonElement;
   primary.addEventListener("click", () => {
+    if (Date.now() - lastAction < 500) return;
+    lastAction = Date.now();
     if (current?.status === "running") sendCommand?.("CashOut");
     else sendCommand?.("Start");
   });
@@ -118,6 +121,15 @@ function build(
   };
 }
 
+/// Stop the chart loop when another screen takes over.
+export function stopCrashAnimation(): void {
+  if (frameHandle !== undefined) {
+    cancelAnimationFrame(frameHandle);
+    frameHandle = undefined;
+  }
+  current = null;
+}
+
 export function renderCrash(
   board: HTMLElement,
   side: HTMLElement,
@@ -125,7 +137,7 @@ export function renderCrash(
   send: (command: unknown) => void,
   now: Clock,
 ): void {
-  if (!parts || parts.board !== board) {
+  if (!parts || parts.board !== board || !parts.canvas.isConnected) {
     parts = build(board, side, send, now);
     lastStatus = "";
   }