feat(metaserver): consume the static Game Protocol 1 directory

[zoeyrose]

Outcome

Discover replacement Game Protocol 1 servers from the static https://meta.atrinik.org/index.json snapshot, with bounded local freshness/fallback behavior and no dependency on classic XML, CGI routes, or dynamic Worker directory reads.

Scope

• Consume the protocol-owned versioned JSON schema/fixtures from atrinik/protocol#12 and the representation contract from atrinik/metaserver-worker#21.
• Fetch the fixed static URL on launch or explicit refresh, honor ETag/conditional requests and cache metadata, and bound response bytes, item count, strings, nesting, and decompression.
• Keep a last-known-good directory snapshot in the client cache only under a documented received-at/freshness policy. Mark stale/offline data visibly and refetch before connection when required; never let stale metadata override certificate identity checks.
• Validate protocol/content compatibility, server ID/certificate material, status/freshness, capacity, optional explicit direct hostname, and any fixed trusted rendezvous capability before displaying/selecting an entry.
• Treat direct hostnames and transient candidates only as routing hints; pin/authenticate the server identity from the protocol contract.
• Never cache or replay transient rendezvous candidates, tickets, authorization transcripts, invite capabilities, or join passwords. Each connection attempt uses fresh signaling/socket state if rendezvous is enabled.
• Use only the fixed trusted Atrinik rendezvous origin selected by the deployment contract. Ignore/reject arbitrary per-server signaling URLs.
• Provide clear empty, offline, stale-cache, schema-version, signature/identity, rate-limit, and unavailable-directory UX while preserving explicit direct-server configuration when discovery is down.

Acceptance criteria

• The default client fetches exactly https://meta.atrinik.org/index.json; ordinary reads cause no dynamic Worker/D1 work.
• Valid empty/maximum snapshots and shared positive/negative schema fixtures parse deterministically within explicit resource bounds.
• ETag/304, cache expiry, last-known-good fallback, clock skew, visible stale state, refresh, and corrupt-cache recovery are tested.
• Classic XML/index.wsgi//v2 parsing and fallback are absent from the replacement client.
• An addressless entry remains selectable when the trusted rendezvous contract supports it; an explicit hostname is treated as opt-in public routing metadata.
• Certificate/server identity remains authoritative across hostname reuse, cache reuse, and directory compromise tests.
• No password, invite, auth transcript, ticket, token, or transient candidate is persisted in the directory cache or logs.
• Direct configured connection remains possible when discovery is unavailable.
• Rust unit/integration/fuzz tests and shared protocol fixtures pass.

Coordination

• atrinik/protocol#12: authoritative discovery schema.
• atrinik/metaserver-worker#13: Game Protocol 1 Worker implementation.
• atrinik/metaserver-worker#21: HTML/XML/JSON static representations.