What's left before a public TestFlight?

[testtest126]

MateMate has come a long way fast: offline play against a real engine, online matchmaking with clocks, rematches (#22), Elo + leaderboard, game review, sounds, themes, and CI on every PR (#23, #27).

Opening this to decide what the actual bar for a first public TestFlight is. A strawman split:

Probably blocking

• Account recovery — guest accounts die with the keychain today (Sign in with Apple for account recovery #14 Sign in with Apple)
• Time controls (Selectable time controls (bullet / blitz / rapid) #13, in progress) — one unnamed default control is hard to market
• Review accuracy (Game review: replace the 1-ply heuristic with the search engine (hung pieces are judged as good moves) #31) — the review currently misgrades hung pieces; embarrassing for a flagship feature
• Server deployment story — everything so far assumes 127.0.0.1:8080; where does the real server live, and what's the migration/versioning plan for the WebSocket protocol?

Nice to have, not blocking

• Bot difficulty levels (Selectable bot difficulty for offline games #36)
• Online E2E in CI (CI: boot chess-server on the runner so the online E2E test stops skipping itself #35)
• JWT5 migration (Migrate to vapor/jwt 5 (JWTKit 5) #21) — internal, invisible to players

Open questions

1. Is matchmaking viable with a tiny player pool, or does the bot need to backfill the queue at launch?
2. Privacy/App Store: what does the guest-account + Elo model need for App Review?
3. Which single metric decides the beta is "working" — games/day, D7 retention, crash-free rate?

Opinions and additions welcome — especially anything you'd remove from the blocking list.