feat(bootstrap): federate LittleSkin by default and let Velocity own its runtime dir

Point Velocity's authlib (mojang.sessionserver) at the felis-api hasJoined multiplexer so
a full install federates Mojang plus the configured [[auth_source]] set out of the box,
not just the standalone `felis nano`, and ship a default LittleSkin auth_source in the
generated felis.toml (delete the block for a Mojang-only server). Velocity now owns
velocity.toml and its working tree — it migrates the config version and extracts
localizations on start — while the jar and forwarding secret stay root-owned read-only and
ReadWritePaths widens to VELOCITY_DIR; the felis-api-internal ClusterIP lookup is factored
into a felis_internal_ip helper shared by the link config and the sessionserver override.
Re-include plugins/velocity in the docker context because the felis binary now embeds all
four plugin trees for `felis bootstrap-assets game-stack`.

.dockerignore

@@ -7,18 +7,19 @@
 .git
 .claude
 **/node_modules
-# plugins/ is code-only and excluded from the MAIN felis image — EXCEPT the source
-# trees the two game images compile: the login-limbo image (deploy/limbo/Dockerfile)
-# builds plugins/limbo, the lobby image (deploy/lobby/Dockerfile) builds plugins/paper,
-# and both srcDir-include the shared link core (plugins/shared).
+# The MAIN felis binary //go:embed-s all four plugin source trees (see
+# bootstrap_asset.go): `felis bootstrap-assets game-stack` emits them as the tar the
+# limbo/lobby images and the host Velocity install build from. Every plugins/ source
+# tree the embed names MUST stay in this context or `go build ./cmd/felis` fails with
+# "pattern plugins/<x>/...: no matching files found".
 # `plugins/*` excludes each sibling module individually (so plugins/ itself is still
-# walked and the negations below can re-include), then the build trees are pulled
-# back in and their Gradle outputs re-excluded to keep the context lean. The main
-# image copies none of plugins/, so carrying these small source dirs is harmless.
+# walked and the negations below can re-include), then the embedded source trees are
+# pulled back in and their Gradle outputs re-excluded to keep the context lean.
 plugins/*
 !plugins/limbo
 !plugins/paper
 !plugins/shared
+!plugins/velocity
 plugins/**/build
 plugins/**/.gradle
 docs