feat: customize login and lobby spaces from the panel

deploy/lobby/README.md

@@ -28,7 +28,7 @@ this at every layer:
 
 ```
 docker build -f deploy/lobby/Dockerfile \
-  --build-arg PAPER_JAR_URL=https://<mirror>/paper-1.21.x-<build>.jar \
+  --build-arg PAPER_JAR_URL=https://<mirror>/paper-26.3-<build>.jar \
   --build-arg PAPER_JAR_SHA256=<sha256 of that jar> \
   -t felis-lobby:demo .
 # Publish into the cluster's registry (on the node; docker treats 127.0.0.1 as
@@ -40,6 +40,30 @@ docker push 127.0.0.1:5000/felis/lobby:demo
 sudo felis setup
 ```
 
+## Customize in the panel
+
+Administrators open **Login & lobby** (`/admin/lobby`). Stop the selected space
+before reading or saving its settings, then start it to apply them. The lobby
+form configures welcome text, menu titles, join behavior, game mode, building
+protection, damage/hunger/void handling, difficulty, time/weather and world rules.
+Settings live in `/data/felis-experience.json`, independently of the image, and
+retain unknown keys when saved. Existing installations without this file use the
+same protected-lobby defaults as before.
+
+The page also exposes the existing file manager (including upload and ZIP
+extraction), console, backups/restore, builder permissions and image/resource
+settings. To replace a map: back up and stop the lobby, upload a world ZIP,
+extract it at the volume root, verify the world directory directly contains
+`level.dat`, and set `level-name` in `server.properties`. Use `setworldspawn x y z`
+in the running lobby console to set its spawn. Plugin JARs go in `plugins/` and
+must match Paper's version; the bundled Felis and LuckPerms JARs are refreshed
+from the image at boot. A custom image must retain the menu/control plugin.
+
+The operator reuses its `init-forwarding` YAML merge for the lobby, preserving
+custom Paper globals while refreshing mandatory authentication settings. The
+image only rewrites that file for standalone runs without a managed forwarding
+initContainer. RCON secrets and the proxy forwarding secret remain managed.
+
 ## Configure (deployer's responsibility)
 
 - Game port must be `25565` (the CRD `GamePort`).
@@ -47,7 +71,7 @@ sudo felis setup
 - The lobby speaks only the `felis:control` plugin-message channel; it holds no
   felis-api token by design (spec §12).
 
-## What the lobby allows
+## Default lobby behavior
 
 felis-paper's `LobbyGuard` keeps the lobby a hub that nobody can hurt, get hurt in,
 or leave a mark on:
@@ -65,6 +89,7 @@ or leave a mark on:
 LuckPerms (`lp user <name> permission set felis.lobby.build true` on the lobby console)
 or op them.
 
-The entrypoint pins `max-players=200` on every boot, over Paper's default of 20: every
+The entrypoint seeds `max-players=200` when absent, over Paper's default of 20;
+subsequent file-editor changes survive restarts: every
 authenticated player passes through here, and a stopped server's players arrive all at
 once.