Complete private authentication, server integrations and activity reporting

Add Fabric/Forge version builds and Paper integration, preserve permanent player identities across renames, harden session authorization, and surface privacy-conscious launcher/server activity in the panel.

panel/server/src/routes/mod.rs

@@ -1,4 +1,5 @@
 pub mod account;
+pub mod activity;
 pub mod admin;
 pub mod meta;
 pub mod public;
@@ -20,6 +21,7 @@ pub fn api(state: &AppState) -> Router<AppState> {
         .route("/auth/register", post(public::register))
         .route("/auth/me", get(public::me))
         .route("/account/profile", get(account::profile))
+        .route("/account/username", axum::routing::put(account::set_username))
         .route("/account/skin", post(account::upload_skin).delete(account::delete_skin))
         .route("/account/skin/model", axum::routing::put(account::set_model))
         .route("/account/cape", axum::routing::put(account::set_cape))
@@ -29,6 +31,7 @@ pub fn api(state: &AppState) -> Router<AppState> {
         .layer(DefaultBodyLimit::max(4 * 1024 * 1024));
 
     let admin = Router::new()
+        .route("/activity", get(activity::list))
         .route("/stats", get(admin::stats))
         .route("/users", get(admin::list_users).post(admin::create_user))
         .route("/users/{id}", axum::routing::patch(admin::update_user).delete(admin::delete_user))
@@ -74,4 +77,5 @@ pub fn api(state: &AppState) -> Router<AppState> {
         .nest("/api/server/v1", game)
         .nest("/api/admin", admin)
         .merge(crate::yggdrasil::routes().layer(DefaultBodyLimit::max(4 * 1024 * 1024)))
+        .layer(axum::middleware::from_fn_with_state(state.clone(), activity::audit))
 }