feat: add browser console UI with session auth and CSRF protection

[Taure]

Summary

Adds a server-rendered admin console UI under /admin/ui/*, on top of the existing bearer-token JSON API under /admin/api/* (unchanged, but see the body-size-limit note below). Covers dashboard, players, matches, matchmaker, leaderboards, economy, tournaments, chat, notifications, and system — one erlydtl page per domain, backed by the existing JSON controllers' business logic (refactored to expose shared do_* functions rather than duplicating it).

Origin: a Discord forum poster requested this, explicitly flagged "not a priority." asobi-architecture-guardian scoped it first — verdict was accept the UI, reject a plugin-contribution model in favor of a static route table, fold it into this repo, and treat session+CSRF auth as the real precondition since a browser form in front of the shared admin token is a materially different attack surface than the existing bearer API.

What's here

• Session auth: single-operator ETS-backed sessions, keyed by hash (not the raw token, since this console is documented to run co-located with the game backend node), invalidated automatically if ASOBI_ADMIN_TOKEN rotates.
• CSRF: HMAC-derived synchroniser token bound to a validated live session (not just any cookie value) — see asobi_admin_csrf_plugin's moduledoc for why the pre-session login route is its own route group entirely rather than a path-string exclusion.
• Security headers: CSP (frame-ancestors 'none'), X-Frame-Options, nosniff, no-store — this console can ban players and grant currency, so clickjacking is a real concern CSRF tokens don't address.
• Login rate limiting: per-IP fixed window, atomic counter, with a trusted_proxy config knob for deployments behind a reverse proxy.
• Request body size cap: applied to every unauthenticated route, including the pre-existing /admin/api/* bearer routes — Nova's plugin pipeline runs before the security fun, so an unbounded body would otherwise buffer fully before auth ever runs.
• Audit logging: every ban/unban/grant/create/broadcast logs its actual outcome, after the action runs (not before, and not assuming success on a rejected write).

Review process

Went through three rounds of asobi-architecture-guardian + beam-security-reviewer, then a final erlang-code-reviewer pass. All findings fixed and re-verified via live execution testing (compiled harnesses, real cowboy listeners, adversarial payloads) rather than diff review alone. Headline findings caught and fixed along the way:

• P0: unauthenticated arbitrary file read via %2F-encoded path traversal in the static asset controller (rewritten as an exact-filename allowlist — no path left to sanitize)
• Structurally-bypassable CSRF exclusion (path-string exclusion → the login route simply isn't wired to the CSRF plugin at all)
• Unauthenticated unbounded body buffering / memory-exhaustion DoS (new asobi_admin_body_limit_plugin, applied to both new and pre-existing route groups)
• Session cookie defaulting to non-Secure, scoped too broadly (Path=/ → Path=/admin/ui), and Nova's own unused default session cookie left with no security attributes
• Non-atomic rate-limiter counter race under concurrent load
• online/offline player-status atom rendering as always-truthy in erlydtl (real bug, not security — fixed by reducing to a boolean before it reaches the template)
• Audit log recording failed/rejected actions as successes, in two cases logging before the action even ran

Toolchain

rebar3 fmt/xref/dialyzer clean. elp lint clean. rebar3 eunit: 113/113 passing. elp eqwalize-all: 91 errors vs main's pre-existing baseline of 82 — both are the same systemic cowboy_req-binding-imprecision pattern already present throughout the codebase (confirmed by diffing against main before any changes); the delta here is closure-wrapping from consolidating the auth guard into one implementation (asobi_admin_ui_auth:guarded/2) instead of ten hand-rolled copies. Dialyzer, which reasons about actual runtime types rather than static narrowing, stays clean throughout.

Test plan

• Full pre-push checklist (fmt/xref/dialyzer/eqwalize/lint/eunit) — see above
• Manual smoke test against a running node (login, browse each domain page, ban/unban/grant, create item/listing/tournament, broadcast)
• Confirm ASOBI_ADMIN_SESSION_SECRET is set before deploying (documented in README, fails closed like ASOBI_ADMIN_TOKEN if missing)