Panel: Yggdrasil auth server (authlib-injector), skins and capes

- Yggdrasil API per the authlib-injector spec: metadata with signing key
  and skin domains, authenticate/refresh/validate/invalidate/signout,
  join/hasJoined, profile lookup, texture upload, and the minecraftservices
  endpoints (chat certificates, publickeys, attributes, blocklist)
- 4096-bit signing key generated once into the data volume; textures and
  chat certificates signed SHA1withRSA (verified with Java's own crypto)
- Skins/capes stored content-addressed after validation and re-encoding;
  cape library with public/group/private visibility; head avatars API
- Launcher login returns a game session; launcher sessions recorded for
  launcher-only servers; authlib-injector download mirror
- Schema v2: player UUIDs (offline UUID backfilled), skins, capes, tokens,
  sessions, chat keys, game server tables
- Remove Microsoft sign-in from the engine and panel

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS

crates/core/tests/online.rs

@@ -34,8 +34,8 @@ async fn run(mc: &str, loader: Loader) {
             uuid: scopenet_shared::offline_uuid("CiBot"),
             access_token: "0".into(),
             user_type: "legacy".into(),
-            xuid: None,
         },
+        agent_args: vec![],
         game_dir,
         memory_min_mb: 512,
         memory_max_mb: 2048,
@@ -94,3 +94,14 @@ async fn forge_1_20_1() {
 async fn neoforge_1_21_1() {
     run("1.21.1", Loader::NeoForge).await;
 }
+
+#[tokio::test]
+#[ignore]
+async fn authlib_injector_official_download() {
+    let dir = tempfile::tempdir().unwrap();
+    let layout = Layout::new(dir.path());
+    let jar = scopenet_core::authlib::ensure(&scopenet_core::http::client(), &layout, None).await.unwrap();
+    let zip = zip::ZipArchive::new(std::fs::File::open(&jar).unwrap()).unwrap();
+    assert!(zip.file_names().any(|n| n == "META-INF/MANIFEST.MF"), "not a jar: {}", jar.display());
+    println!("authlib-injector: {}", jar.display());
+}