feat: backfill into running matches, a joinable flag, and script-driven bots

[Taure]

A forum post asked for four things around joining matches that have already
started. Two already existed and one of those was broken; two did not.

Already there, and broken

match.list discovers live matches and a running match accepts joins, so
backfill needed no new call. But the session only ever learned its match_pid
from the matchmaker, so a player who found a match and joined it by id - the
backfill path - was left unbound: their match.input came back
not_in_match and their match.leave silently did nothing.

asobi_match_server now sends match_joined on the join it accepted,
mirroring asobi_world_server, and match_left on the way out so a stale
match_pid cannot outlive the match. The matchmaker's own send goes away with
it - it fired even when the join it announced had failed, because the fan-out
discards the join result.

ws_backfill_join_binds_the_session drives the whole path over a real socket.
Reverting the one-line fix makes it fail with exactly the not_in_match frame
a player would have hit.

New

A runtime joinable flag. game.match.set_joinable(false) closes a match
to new players without ending it; further joins get match_locked. Reported
in every listing and filterable in match.list, GET /api/v1/matches/live
and asobi_match_lobby.

Deliberately separate from has_capacity: a match with three free slots may
have closed itself, and a full one has not - it may free a slot on the next
leave. A client looking for somewhere to play asks both.

There is no config key. listed is static because "should this mode be
browsable" is a property of the mode; "will this match take another player
right now" is a property of the moment, and a match that started closed could
never be joined at all.

Lua join can refuse. return nil, "reason" (and return false - Lua has
two falsey values and return cond and state or false is ordinary). Replaces
the documented workaround of admitting the player with a spectator flag.

A refused player never reaches the roster and the Lua state is discarded, so a
refusal leaves no trace - a client cannot drive a script by being turned away
repeatedly. The reason is game vocabulary and rides in
details.refused_reason under the fixed code match.join_refused; a script
still cannot mint a code. Bounded at 64 bytes of printable ASCII.

game.bots.add/remove. A match script placing bots itself instead of
relying on matchmaker queue fill. Routed through asobi_bot_spawner because
asobi_bot joins from its own init/1 - starting one from inside the match
process would block that process in supervisor:start_child/2 while the new
bot waited on it to answer the join. Shares the MAX_BOT_FILL ceiling.
Independent of bots.enabled, which governs queue fill only.

Fixed along the way

• A Lua join that returned nothing was a case_clause that killed the match
  server and everyone in it. Now a logged refusal - a script bug should cost
  the author their own join, not the whole match.
• started_at was restamped by every join past min_players, so each
  backfill joiner restarted the clock the persisted match duration is measured
  from.
• A non-atom reason at the socket hit no to_reason_binary/1 clause;
  safe_handle_message caught the function_clause and answered
  invalid_payload, blaming the client for a server-side fault. Now
  internal.
• The bot scan only ran once per match id, so a script-placed bot would never
  have got an AI - and could have got a second one. It now skips bots that
  already have a process.
• game.match.* and game.bots.* matched on match_pid, which a world and a
  zone VM also bind - to the world server. asobi_world_server answers
  get_info and {join, _, _} with the same shapes, so bots.add from a
  world script would have quietly seated a bot in a world; and its running/3
  has no catch-all, so the set_joinable cast would have died on
  function_clause and taken the world down with every player in it. Both now
  gate on vm_kind/1.

Wire and API surface

• New error codes: match.full, match.locked, match.join_refused. match_full
  previously came through as ws.request_failed.
• New field joinable on match.joined and every match.list entry. Additive;
  both protocol fixtures updated.
• New filter joinable on match.list and GET /api/v1/matches/live.
• New Lua namespaces game.match and game.bots.
• New presence message {match_left, pid()}.

The SDKs do not read joinable or branch on the new codes yet - worth a
/sync-sdks pass before this is announced.

Verification

fmt, xref, dialyzer, ex_doc clean. 1730 eunit + 356 CT, zero failures.
Mutation testing on the changed lines: asobi_match_server,
asobi_ws_handler, asobi_bot_spawner, asobi_match_lobby at 100%,
asobi_lua_match at 97% (the survivor is a log call with no observable
effect). Its first run found three genuine gaps - the REST filter untested,
bot_pids only reached through a mock, loose refusal bounds - which is the
second commit.

eqwalizer is net zero against main (312 both sides). That standing count is
a pre-existing repo-wide condition across files this branch does not touch.

Docs

lua-scripting, lua-api, lua-bots, lobbies, matchmaking, rest-api
and websocket-protocol, plus both protocol fixtures. lobbies.md gains a
"Joining a match already in progress" section and matchmaking.md states
plainly that the matchmaker never routes a queued player into a running match

• backfill is discovery, not a strategy.

[github-actions]

🟡 Code Coverage — 76.2%

7064 of 9273 lines covered.