feat(rcon): add admin server console

docs/rcon.md

@@ -0,0 +1,43 @@
+# RCON administration
+
+The administrator RCON console proxies commands through the Next.js server runtime. Browsers never receive RCON credentials and never open RCON sockets.
+
+## Application configuration
+
+Set `RCON_ALLOWED_ENDPOINTS` to a comma-separated allowlist of exact internal `host:port` pairs:
+
+```text
+RCON_ALLOWED_ENDPOINTS=season4.somc.svc.cluster.local:25575
+```
+
+IP literals, trailing-dot hostnames, malformed DNS names, and endpoints absent from the allowlist are rejected whenever a connection is saved, tested, or used.
+
+Saved passwords are encrypted with AES-256-GCM and connection-bound authenticated data. By default, domain-separated credential and audit keys are derived from `AUTH_SECRET`. Deployments may instead provide independent 32-byte base64 values through `RCON_CREDENTIAL_KEY` and `RCON_AUDIT_KEY`. Rotating the credential key requires replacing saved RCON passwords.
+
+## Minecraft server configuration
+
+Enable RCON with a high-entropy password supplied through the deployment secret. Expose its port only on an internal `ClusterIP` service. Do not add RCON to an Ingress, NodePort, or public LoadBalancer.
+
+The password entered in the administrator connection form must match the server password. Existing passwords are write-only; leave the replacement field blank when editing unrelated connection settings.
+
+## Security behavior
+
+- Existing account-manager administrator authorization is rechecked for every connection mutation, test, and command.
+- Commands are limited to 1,024 UTF-8 bytes and reject control characters.
+- Each web process allows one operation per connection and at most eight RCON operations total. Size replica counts with that aggregate ceiling in mind.
+- Each complete connect-and-response operation times out after five seconds and tears down the socket; cleanup is independently capped at one second.
+- Responses are sanitized and limited to 64 KiB.
+- Full commands and responses are not persisted or logged. Audit events contain the command verb and a domain-separated HMAC digest.
+- Connection passwords are never selected by page queries or returned to the browser.
+
+RCON is plaintext TCP. Keep it on the cluster network and use network policy or an encrypted tunnel when the network trust model requires stronger isolation.
+
+## Migration
+
+Apply the generated Drizzle migration before deploying the web image:
+
+```bash
+npx drizzle-kit migrate
+```
+
+Never use `drizzle push` for this schema change.