feat(security): security role model + moderation commands

[ncipollina]

📋 Summary

Implements PLAN-0005/ADR-0005: a SecurityRole permission model and eight moderation commands (boot, mute/unmute, announce, ban/unban, rolegrant/rolerevoke), plus the bootstrap mechanism that grants the very first admin via an env var. The plan was written before ADR-0006/0008's Host→Hosting+Adapters split and the Ruleset scaffolding tier, so it was re-validated and corrected against the current architecture before implementation started (see the ADR's dated Correction note and the plan's "Validated against current architecture" section).

📝 Changes

Permission model

• SecurityRole — [Flags] enum : uint with explicit power-of-two values, plus a SecurityRoleExtensions (C# 14 extension block) defining the role hierarchy: FullAdmin → MinorAdmin → Player and FullBuilder → MinorBuilder → Player. The admin and builder ladders are deliberately independent of each other.
• RoleGuardedCommand/MuteGuardedCommand — decorators wrapping ICommand to check role/mute state before delegating, so individual commands never implement permission checks themselves.
• ICommandRegistry.RegisterOpen/RegisterWithRole replace the old single Register method across all call sites.
• PlayerBehavior: Roles, IsMuted, IsBanned (persisted) + WasBooted (transient, never saved). GrantRole accumulates downward through the hierarchy; RevokeRole enforces the hierarchy invariant and returns string? (not an exception) on a normal business-rule failure.

Moderation commands (src/SharpMud.Engine/Commands/Builtin/Admin/)

• BootCommand/MuteCommand/UnmuteCommand/AnnounceCommand (MinorAdmin), BanCommand/UnbanCommand/RoleGrantCommand/RoleRevokeCommand (FullAdmin), registered via AdminCommands.RegisterAll.
• HelpCommand filters role-gated commands out of the listing for actors who can't run them.

Bootstrap + enforcement

• SHARPMUD_INITIAL_ADMIN env var (SharpMudHostOptions) — LoginFlow grants that username FullAdmin on login, idempotently, since granting a role otherwise requires already holding FullAdmin.
• LoginFlow rejects banned accounts at password verification with a distinct message.
• SessionLoop treats WasBooted exactly like an explicit quit (immediate removal, not Linkdead) — without this, boot/ban would just look like a dropped connection and the player could reconnect and resume.
• Wired into samples/SharpMud.Samples.Classic/Program.cs (env var passthrough, SharpMudHostOptions DI registration, AdminCommands.RegisterAll via the Rpg ruleset's registerConsumerCommands callback).

Docs

• docs/commands.md, docs/accounts-auth.md, docs/deployment.md (SHARPMUD_INITIAL_ADMIN runtime config), SPEC.md, docs/adr/README.md/docs/plans/README.md, and docs/plans/0001-wheelmud-reconciliation-roadmap.md (Slice 3) all updated to reflect the implemented state.

🧪 Validation

• Build/test status: 221/221 tests passing (dotnet test SharpMud.slnx).
• Manual verification performed: ran the real Classic sample over actual Telnet connections and walked through all 9 steps in the plan's Verification section — fresh-server bootstrap (role accumulation confirmed), restart idempotency, rolegrant + permission boundaries, mute/unmute, ban/unban (including login rejection), boot + immediate-reconnect regression check (confirms a fresh login prompt, not a Welcome back resume), announce broadcast, non-admin rejection of all 5 gated commands, and restart persistence of Roles/IsMuted/IsBanned (with WasBooted correctly not surviving).
• Edge cases checked: role-hierarchy revoke guard (can't revoke a role that's implied by a higher one still held, in both the admin and builder ladders), self-ban rejection, granting/revoking unknown or None/All role names, muted player's say/emote blocked with a clear message, offline vs. online vs. linkdead moderation targets.

💬 Notes for Reviewers

• Found and documented (not fixed, out of scope) one pre-existing, unrelated bug during manual verification: the game loop's WanderManager tick can crash the whole process if it broadcasts to a room occupant whose session has already disconnected (Linkdead) — an unhandled IOException/SocketException writing to a dead socket. Noted in the plan's Verification section for a follow-up.
• Audit logging of moderation actions is explicitly out of scope for this PR (tracked as an open item in the plan/SPEC.md).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[ncipollina]

💬 Full process-conformance + correctness review of PLAN-0005/ADR-0005's implementation. No 🐛 blocking findings - ADR/plan/docs are all correctly updated in this PR (including an honest ADR correction note for the ADR-0006/0008 drift), the role-hierarchy accumulate/revoke logic is correct (including the builder→Player fix in the last commit), boot/ban session-boundary handling is correctly ordered and tested, self-lockout guards are present, and 221 tests pass. Left 3 📝 optional suggestions inline: a set of 6 new xUnit1051 warnings in the Admin command tests (main has zero today), and two small duplication/efficiency nits in BootCommand/AnnounceCommand. None block merge - your call on whether to pick them up now or later.