Complete private authentication, server integrations and activity reporting

Add Fabric/Forge version builds and Paper integration, preserve permanent player identities across renames, harden session authorization, and surface privacy-conscious launcher/server activity in the panel.

panel/server/src/routes/admin.rs

@@ -178,11 +178,15 @@ pub async fn update_user(
         .ok_or_else(|| AppError::not_found("user not found"))?;
     if let Some(password) = input.password.filter(|p| !p.is_empty()) {
         auth::validate_password(&password)?;
-        sqlx::query("UPDATE users SET password_hash = ? WHERE id = ?")
+        let mut tx = state.db.begin().await?;
+        sqlx::query("UPDATE users SET password_hash = ?, auth_version = auth_version + 1 WHERE id = ?")
             .bind(auth::hash_password(&password)?)
             .bind(id)
-            .execute(&state.db)
+            .execute(&mut *tx)
             .await?;
+        sqlx::query("DELETE FROM ygg_tokens WHERE user_id=?").bind(id).execute(&mut *tx).await?;
+        sqlx::query("DELETE FROM ygg_sessions WHERE user_id=?").bind(id).execute(&mut *tx).await?;
+        tx.commit().await?;
     }
     if let Some(email) = input.email {
         sqlx::query("UPDATE users SET email = ? WHERE id = ?")