M2.1: dedicated server, joining, identity handshake, names, lobby

- Net autoload: headless dedicated server (--server) on UDP 24242 via ENet,
  server.json preferences (flags override per run, never saved), reserved
  names in names.json
- Identity: RSA-2048 key per install (Godot has no Ed25519), player id =
  key hash, challenge/response so ids can't be faked; profile with name
  and limited appearance (tunic, hair, beard)
- Server refuses bans, allowlist misses, duplicate logins, bad or taken
  names, wrong passwords, old protocol versions and a full server, each
  with a clear reason; first player on a new server becomes admin
- Title screen: Profile, Join Game, and a lobby with server info, rules
  and who's online
- test_net_lobby: real headless server + bot processes over UDP (38
  checks); --exit-with so test servers never outlive the test

docs/ROADMAP.md

@@ -44,7 +44,7 @@ Detailed plan in `docs/MULTIPLAYER_PLAN.md` (hosting on UDP 24242 via Tailscale
 or port forwarding, player identity and names, server rules for co-op/PvP, and
 phases M2.0-M2.7).
 - [ ] Refactor state to server-authoritative (single-player becomes loopback server)
-- [ ] Headless dedicated server mode (`--headless -- --server`)
+- [x] Headless dedicated server, joining, identity handshake, names, player list *(M2.1)*
 - [ ] ENet transport, client prediction for local movement, interpolation for others
 - [ ] Replicate resource nodes, inventory, building, health
 - [ ] Persistence: world save/load on the server