fix(lobby): 大厅变成安全的中转大厅并提示 /menu，大厅上限 200、登录门不限人数

deploy/lobby/README.md

@@ -46,3 +46,25 @@ sudo felis setup
 - Align `online-mode` / player forwarding with the off-cluster Velocity proxy.
 - The lobby speaks only the `felis:control` plugin-message channel; it holds no
   felis-api token by design (spec §12).
+
+## What the lobby allows
+
+felis-paper's `LobbyGuard` keeps the lobby a hub that nobody can hurt, get hurt in,
+or leave a mark on:
+
+- every world is peaceful, with natural spawning, PvP, mob griefing and TNT off,
+  time frozen at noon, clear weather and inventories kept;
+- players take no damage and never go hungry; a fall into the void lands at spawn;
+- a player without `felis.lobby.build` joins at spawn in adventure mode and cannot
+  break or place blocks, use buckets, trample farmland, light fires, or harm mobs,
+  item frames, paintings, armor stands or vehicles. Buttons, doors, pressure plates
+  and containers keep working;
+- every join gets a chat line with a click that runs `/menu`.
+
+`felis.lobby.build` defaults to ops. To let an admin build the lobby, grant it with
+LuckPerms (`lp user <name> permission set felis.lobby.build true` on the lobby console)
+or op them.
+
+The entrypoint pins `max-players=200` on every boot, over Paper's default of 20: every
+authenticated player passes through here, and a stopped server's players arrive all at
+once.

deploy/lobby/entrypoint.sh

@@ -57,7 +57,11 @@ set_prop() {
     # otherwise corrupt this bare sed s||| and silently break the key. Same escaping as
     # deploy/limbo — without it an unlucky password kills the console/permission channel.
     esc=$(printf '%s' "$2" | sed 's/[|\\&]/\\&/g')
-    sed -i "s|^$1=.*|$1=${esc}|" "$PROPS"
+    # Through a temp file rather than sed -i, which BSD sed reads differently, so the
+    # same function runs under the entrypoint tests on any machine.
+    sed "s|^$1=.*|$1=${esc}|" "$PROPS" > "$PROPS.tmp"
+    cat "$PROPS.tmp" > "$PROPS"
+    rm -f "$PROPS.tmp"
   else
     printf '%s=%s\n' "$1" "$2" >> "$PROPS"
   fi
@@ -66,6 +70,14 @@ set_prop() {
 set_prop server-port "$PORT"
 set_prop online-mode false
 
+# Every authenticated player passes through the lobby, and a stopped server's players
+# arrive together (they fall back to the login gate, which sends them straight on).
+# Paper's default cap of 20 would turn the 21st away at the door. 200 is far above
+# what one node serves at once, and a flood beyond it is refused at the door instead
+# of running the 1Gi lobby out of memory. What the world itself allows (no damage, no
+# building, the /menu hint) is felis-paper's LobbyGuard.
+set_prop max-players 200
+
 # RCON is the control plane's write channel (spec §8 写=RCON): the operator probes it
 # for readiness and the player tally, and felis-api runs console/permission commands over
 # it. Paper only reads these three keys from server.properties, so the operator's injected