Panel: Yggdrasil auth server (authlib-injector), skins and capes

- Yggdrasil API per the authlib-injector spec: metadata with signing key
  and skin domains, authenticate/refresh/validate/invalidate/signout,
  join/hasJoined, profile lookup, texture upload, and the minecraftservices
  endpoints (chat certificates, publickeys, attributes, blocklist)
- 4096-bit signing key generated once into the data volume; textures and
  chat certificates signed SHA1withRSA (verified with Java's own crypto)
- Skins/capes stored content-addressed after validation and re-encoding;
  cape library with public/group/private visibility; head avatars API
- Launcher login returns a game session; launcher sessions recorded for
  launcher-only servers; authlib-injector download mirror
- Schema v2: player UUIDs (offline UUID backfilled), skins, capes, tokens,
  sessions, chat keys, game server tables
- Remove Microsoft sign-in from the engine and panel

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS

panel/server/src/routes/mod.rs

@@ -1,3 +1,4 @@
+pub mod account;
 pub mod admin;
 pub mod meta;
 pub mod public;
@@ -16,7 +17,15 @@ pub fn api(state: &AppState) -> Router<AppState> {
         .route("/launcher/events", post(public::event))
         .route("/auth/login", post(public::login))
         .route("/auth/register", post(public::register))
-        .route("/auth/me", get(public::me));
+        .route("/auth/me", get(public::me))
+        .route("/account/profile", get(account::profile))
+        .route("/account/skin", post(account::upload_skin).delete(account::delete_skin))
+        .route("/account/skin/model", axum::routing::put(account::set_model))
+        .route("/account/cape", axum::routing::put(account::set_cape))
+        .route("/avatar/{id}", get(account::avatar))
+        .route("/launcher/authlib-injector.json", get(account::authlib_index))
+        .route("/launcher/authlib-injector.jar", get(account::authlib_jar))
+        .layer(DefaultBodyLimit::max(4 * 1024 * 1024));
 
     let admin = Router::new()
         .route("/stats", get(admin::stats))
@@ -34,6 +43,11 @@ pub fn api(state: &AppState) -> Router<AppState> {
         .route("/instances/{id}/import/upload", post(admin::import_upload))
         .route("/instances/{id}/files", post(admin::upload_files).delete(admin::delete_file))
         .route("/uploads", post(admin::upload_media))
+        .route("/users/{id}/skin", post(admin::admin_set_skin).delete(admin::admin_delete_skin))
+        .route("/users/{id}/cape", axum::routing::put(admin::admin_set_cape))
+        .route("/capes", get(admin::list_capes).post(admin::create_cape))
+        .route("/capes/{id}", axum::routing::put(admin::update_cape).delete(admin::delete_cape))
+        .route("/auth-server", get(admin::auth_server_info))
         .route("/meta/minecraft", get(meta::minecraft))
         .route("/meta/loaders/{loader}", get(meta::loaders))
         .route("/modrinth/search", get(meta::modrinth_search))
@@ -42,5 +56,8 @@ pub fn api(state: &AppState) -> Router<AppState> {
         .route("/curseforge/mod/{id}/files", get(meta::curseforge_files))
         .layer(DefaultBodyLimit::max(upload_limit));
 
-    Router::new().nest("/api/v1", launcher).nest("/api/admin", admin)
+    Router::new()
+        .nest("/api/v1", launcher)
+        .nest("/api/admin", admin)
+        .merge(crate::yggdrasil::routes().layer(DefaultBodyLimit::max(4 * 1024 * 1024)))
 }