Harden profiled founder admission and castle ownership

[ael-dev3]

Summary

• require a complete normalized Farcaster username and public HTTPS profile image before first-time founder admission
• create admission, permanent castle assignment, public profile, Marks account, resource account, and audit atomically
• keep castle control bound exclusively to the founder's genuine authenticated SpacetimeDB identity, with selector-free authority for future gameplay reducers
• add a private expiring one-use founder-admission plan with per-founder profile-source approval, exact v3/v4 preflight and postflight checks, and privacy-safe ambiguous-outcome handling
• harden required-profile repair, full profile-map drift checks, generated bindings, additive migration proof, tests, and operational documentation

Verification

• npm run typecheck
• npm test — 147 files / 1,506 tests
• npm run build
• SpacetimeDB typecheck and pure tests — 135 tests
• npm run stdb:verify-bindings
• npm run stdb:verify-additive-migration — additive proof passed with data deletion disabled in disposable loopback fixtures

Publication boundary

This draft PR does not publish the SpacetimeDB module, admit a founder, mutate production data, merge other PRs, or change the live frontend. Module publication and any later founder admission remain separate explicit approval gates.

[ael-dev3]

Superseded by the audited Alpha 0.3.11 integration in #64, now merged to protected main. Accepted work was reconciled, corrected where needed, and validated there; this original branch is intentionally not merged again.