- Net autoload: headless dedicated server (--server) on UDP 24242 via ENet,
server.json preferences (flags override per run, never saved), reserved
names in names.json
- Identity: RSA-2048 key per install (Godot has no Ed25519), player id =
key hash, challenge/response so ids can't be faked; profile with name
and limited appearance (tunic, hair, beard)
- Server refuses bans, allowlist misses, duplicate logins, bad or taken
names, wrong passwords, old protocol versions and a full server, each
with a clear reason; first player on a new server becomes admin
- Title screen: Profile, Join Game, and a lobby with server info, rules
and who's online
- test_net_lobby: real headless server + bot processes over UDP (38
checks); --exit-with so test servers never outlive the test
