fix: resolve all remaining audit failures across rust, svelte, and java

panel/web/src/App.svelte

@@ -24,6 +24,8 @@
   import { toast } from './lib/toast.svelte';
 
   let brand = $state<{ name: string; logo_url: string | null }>({ name: 'SCOPENET', logo_url: null });
+  let landingEnabled = $state<boolean | null>(null);
+  $effect(() => { get<{enabled: boolean}>('/api/v1/landing').then(c => landingEnabled = c.enabled).catch(() => landingEnabled = false); });
   let checking = $state(!!session.token);
 
   $effect(() => {
@@ -54,12 +56,12 @@
   });
 </script>
 
-{#if checking}
+{#if checking || landingEnabled === null}
   <div class="boot"><span class="pulse"></span></div>
-{:else if route.name === 'landing'}
+{:else if route.name === 'landing' && landingEnabled}
   <PublicLanding />
 {:else if !session.user}
-  {#if route.name === 'login'}
+  {#if route.name === 'login' || !landingEnabled}
     <Login brandName={brand.name} logo={brand.logo_url} />
   {:else}
     <PublicLanding />

panel/web/src/components/ServerForm.svelte

@@ -1,5 +1,9 @@
 <script lang="ts">
   import { Globe, UserRound, Tag } from '@lucide/svelte';
+  import { onMount } from 'svelte';
+  import { get } from '../lib/api';
+  let instances = $state<Array<{id: string; name: string}>>([]);
+  onMount(async () => { instances = await get('/api/admin/instances'); });
   import Toggle from './Toggle.svelte';
   import type { Group, ServerDraft } from '../lib/types';
 
@@ -13,6 +17,7 @@
 </script>
 
 <label class="field">Name<input bind:value={draft.name} maxlength="48" placeholder="Survival SMP" /></label>
+<label class="field">Launcher instance<select bind:value={draft.instance_id}><option value="">Unlinked</option>{#each instances as instance}<option value={instance.id}>{instance.name}</option>{/each}</select></label>
 <div class="field">
   <span class="lbl">Who can join</span>
   <div class="opts">
@@ -38,7 +43,7 @@
 <Toggle
   bind:checked={draft.require_launcher}
   label="Must join through the launcher"
-  help="Accounts are only let in if they launched the game from the SCOPENET launcher on the same network in the last 12 hours. Useful for offline-mode servers."
+  help="Accounts are only let in if they launched the game from the SCOPENET launcher from the same IP address in the last 12 hours."
 />
 
 <style>

panel/web/src/lib/types.ts

@@ -90,6 +90,7 @@ export interface Cape { id: number; name: string; url: string; visibility: 'publ
 export interface AuthServerInfo { public_url: string; yggdrasil_url: string; public_key: string }
 
 export interface GameServer {
+  instance_id: string;
   id: number;
   name: string;
   token_hint: string;
@@ -138,7 +139,7 @@ export interface ServerDetail {
 
 export interface UserActivity { servers: PlayerStats[]; events: ServerEvent[]; online_on: { id: number; name: string }[] }
 
-export type ServerDraft = { name: string; access: 'all' | 'members' | 'groups'; allowed_groups: string[]; require_launcher: boolean };
+export type ServerDraft = { instance_id?: string; name: string; access: 'all' | 'members' | 'groups'; allowed_groups: string[]; require_launcher: boolean };
 
 export interface HostedDownload {
   platform: 'windows' | 'mac' | 'linux';
@@ -238,6 +239,7 @@ export interface UserQuest {
 }
 
 export interface Achievement {
+  requirement_type?: string;
   id: string;
   title: string;
   description: string;

panel/web/src/pages/AchievementEditor.svelte

@@ -73,6 +73,7 @@
         icon_item: a.icon_item || 'diamond_pickaxe',
         icon_bg: a.icon_bg || 'deepslate',
         icon_border: a.icon_border || 'gold',
+        requirement_type: a.requirement_type || 'stat',
         stat_type: a.stat_type || a.requirement_key || 'blocks_broken',
         target_count: a.target_count || a.requirement_value || 1,
         secret: !!a.secret,

panel/web/src/pages/ServerDetail.svelte

@@ -78,7 +78,7 @@
 
   function openEdit() {
     if (!s) return;
-    draft = { name: s.name, access: s.access, allowed_groups: [...s.allowed_groups], require_launcher: s.require_launcher };
+    draft = { instance_id: s.instance_id, name: s.name, access: s.access, allowed_groups: [...s.allowed_groups], require_launcher: s.require_launcher };
     editOpen = true;
   }
   async function saveEdit() {