feat: customize login and lobby spaces from the panel

deploy/lobby/README.md

@@ -28,7 +28,7 @@ this at every layer:
 
 ```
 docker build -f deploy/lobby/Dockerfile \
-  --build-arg PAPER_JAR_URL=https://<mirror>/paper-1.21.x-<build>.jar \
+  --build-arg PAPER_JAR_URL=https://<mirror>/paper-26.3-<build>.jar \
   --build-arg PAPER_JAR_SHA256=<sha256 of that jar> \
   -t felis-lobby:demo .
 # Publish into the cluster's registry (on the node; docker treats 127.0.0.1 as
@@ -40,6 +40,30 @@ docker push 127.0.0.1:5000/felis/lobby:demo
 sudo felis setup
 ```
 
+## Customize in the panel
+
+Administrators open **Login & lobby** (`/admin/lobby`). Stop the selected space
+before reading or saving its settings, then start it to apply them. The lobby
+form configures welcome text, menu titles, join behavior, game mode, building
+protection, damage/hunger/void handling, difficulty, time/weather and world rules.
+Settings live in `/data/felis-experience.json`, independently of the image, and
+retain unknown keys when saved. Existing installations without this file use the
+same protected-lobby defaults as before.
+
+The page also exposes the existing file manager (including upload and ZIP
+extraction), console, backups/restore, builder permissions and image/resource
+settings. To replace a map: back up and stop the lobby, upload a world ZIP,
+extract it at the volume root, verify the world directory directly contains
+`level.dat`, and set `level-name` in `server.properties`. Use `setworldspawn x y z`
+in the running lobby console to set its spawn. Plugin JARs go in `plugins/` and
+must match Paper's version; the bundled Felis and LuckPerms JARs are refreshed
+from the image at boot. A custom image must retain the menu/control plugin.
+
+The operator reuses its `init-forwarding` YAML merge for the lobby, preserving
+custom Paper globals while refreshing mandatory authentication settings. The
+image only rewrites that file for standalone runs without a managed forwarding
+initContainer. RCON secrets and the proxy forwarding secret remain managed.
+
 ## Configure (deployer's responsibility)
 
 - Game port must be `25565` (the CRD `GamePort`).
@@ -47,7 +71,7 @@ sudo felis setup
 - The lobby speaks only the `felis:control` plugin-message channel; it holds no
   felis-api token by design (spec §12).
 
-## What the lobby allows
+## Default lobby behavior
 
 felis-paper's `LobbyGuard` keeps the lobby a hub that nobody can hurt, get hurt in,
 or leave a mark on:
@@ -65,6 +89,7 @@ or leave a mark on:
 LuckPerms (`lp user <name> permission set felis.lobby.build true` on the lobby console)
 or op them.
 
-The entrypoint pins `max-players=200` on every boot, over Paper's default of 20: every
+The entrypoint seeds `max-players=200` when absent, over Paper's default of 20;
+subsequent file-editor changes survive restarts: every
 authenticated player passes through here, and a stopped server's players arrive all at
 once.

deploy/lobby/entrypoint.sh

@@ -76,7 +76,10 @@ set_prop online-mode false
 # what one node serves at once, and a flood beyond it is refused at the door instead
 # of running the 1Gi lobby out of memory. What the world itself allows (no damage, no
 # building, the /menu hint) is felis-paper's LobbyGuard.
-set_prop max-players 200
+# Seed capacity once; administrators can tune it in the panel file editor.
+if ! grep -q '^max-players=' "$PROPS"; then
+  set_prop max-players 200
+fi
 
 # RCON is the control plane's write channel (spec §8 写=RCON): the operator probes it
 # for readiness and the player tally, and felis-api runs console/permission commands over
@@ -105,21 +108,21 @@ else
   echo "  injects it from the <server>-rcon Secret when spec.rcon.enabled is true." >&2
 fi
 
-# Rewritten whole, not merged. Paper loads this file and fills every key it does
-# not find with the default, then writes the full tree back — so a proxies-only file is a
-# complete, stable input, and the lobby's other globals are simply always the defaults.
-# That is true of a system server Felis owns end to end; if admins are ever allowed to tune
-# the lobby's globals, this has to become a real YAML merge (yq) instead.
+# The operator's existing init-forwarding step merges the proxy keys on every
+# start, preserving other Paper globals. Standalone runs retain the mandatory
+# rewrite because no initContainer has verified their forwarding settings.
 mkdir -p config
-cat > config/paper-global.yml <<YAML
-# Written by felis-lobby's entrypoint on every boot. Do not hand-edit: the forwarding
-# secret is injected from the felis-forwarding-secret Secret and must match the proxy.
+if [ "${FELIS_MANAGED_FORWARDING:-false}" = true ]; then
+  [ -f config/paper-global.yml ] || { echo "felis-lobby: missing managed forwarding config" >&2; exit 1; }
+else
+  cat > config/paper-global.yml <<YAML
 proxies:
   velocity:
     enabled: true
     online-mode: true
     secret: "${SECRET}"
 YAML
+fi
 
 echo "felis-lobby: server-port=${PORT}, velocity modern forwarding on (UUIDs are Mojang-verified)"
 JAVA_MEMORY_ARG=""