v0.2.0-beta.4

Added

• operator: fleet metric gameplane_gameservers{phase=…} exported on the
  operator's /metrics endpoint — one gauge per GameServer lifecycle phase,
  computed from the controller cache at scrape time (so it never drifts from
  reconcile state). The bundled Grafana dashboard gains "GameServers
  running/failed" stats and a stacked "GameServers by phase" graph, and
  prometheusRules.enabled gains a GameplaneGameServerFailed alert. Until
  now the dashboard and alerts plotted only controller-runtime internals; this
  is the first domain metric.
• operator: companion fleet metric gameplane_backups{phase=…} (one gauge
  per Backup phase), with a "Backups failed" stat + stacked "Backups by phase"
  graph on the dashboard and a GameplaneBackupFailed alert — a silently failed
  backup is a data-loss risk, so it's worth paging on.
• ci: the published component images (:edge on every main push and the
  versioned images on a v* release) are now keyed-cosign-signed by digest
  (offline, no Rekor), matching the official module bundles. Verify with
  cosign verify --key cosign.pub ghcr.io/valgulnecron/gameplane/<component>.
  Gated on COSIGN_PRIVATE_KEY, so publishing still works before the key is set.
  Signing and publishing run only on main/tags, never on PRs.
• api: server-side audit-log export — GET /admin/audit/export?format=csv|json
  (admin-only) streams the entire audit trail, optionally bounded by RFC3339
  since/until. Unlike the dashboard's client-side CSV (only the loaded page),
  this returns the full log in one download for compliance/archival, streamed
  row-by-row so a large table isn't buffered in memory.
• api: outbound audit-log webhook push sink — set api.audit.webhook.url
  and the API POSTs each audit event as JSON to that endpoint (a log aggregator's
  push API, a SIEM, or your own receiver), alongside the database. It mirrors,
  never gates: events always persist, and a slow or unreachable endpoint never
  blocks or fails a request (bounded async buffer, drop-and-count on overflow,
  surfaced at gameplane_audit_webhook_events_total{result=sent|failed|dropped}
  on /metrics). An optional Authorization header is Secret-sourced
  (api.audit.webhook.authSecretRef), never a flag.
• audit-syslog-bridge: a new, generic HTTP-JSON → syslog relay image that
  sits behind the audit webhook sink, so audit events can be forwarded to a
  syslog/SIEM collector (RFC 5424 over TCP, TCP+TLS, or UDP). Deploy the bundled
  relay with api.audit.webhook.syslogBridge.enabled=true +
  …syslogBridge.syslog.addr, and the chart auto-points the webhook at it (off
  by default). The bridge forwards the request body verbatim, so it works for
  any JSON webhook source, not just Gameplane.

Changed

• chart: the bundled defaultModuleSource now defaults to a git source
  that indexes the public gameplane-module repository, so the official games
  appear in the Modules page out of the box — no OCI registry to publish first.
  Set defaultModuleSource.type: oci to pull (optionally cosign-signed) bundles
  from a registry instead. Breaking values change: the former top-level
  url / insecure / modules / pullSecretName / verify keys moved under
  defaultModuleSource.oci.*.
• chart: the official module-signing public key (ed25519) now ships in
  defaultModuleSource.oci.verify.cosignPublicKey, so verifying official bundles
  is just type: oci + oci.verify.enabled: true — no key to paste. Still off
  by default.

Fixed

• operator: the Servers list "Node" column was always blank — nothing ever
  set the gameplane.local/node annotation the dashboard reads. The GameServer
  reconciler now keeps it in sync with the node the game pod is scheduled on
  (and clears it when the server is stopped), so the column shows real placement.