feat(system builder 2a): store custom systems, with the definition fo…

[over2take]

…rmat and its checks

custom_systems keeps a draft the builder edits and the published copy a game runs. Definition format 1 (name, description, words, parts, lookups, derived) is checked on the server: fatal problems (not an object, too large, not JSON) refuse storage; ordinary ones are saved in a draft and block publishing; all reported with where they are. Ids are sys_ + hex and never collide with a built-in id.

GM-only routes at /api/systems (requireMainAdmin: granted editors are refused): list, create from a name or a definition, read, save draft, publish, delete (refused for the running system). Nothing in the game reads them yet (2d).

Tests: definition checks, words and parts defaults, the routes' rules, and the auth walk now covers the systems routes; mutation-checked.

Summary

Test plan

• Tested locally
• Tests pass

Pre-merge checklist

Code quality:

• Code follows project style
• No breaking changes (or clearly documented)
• No console errors or warnings

Version & Release:

• Version bumped? If releasing to users, update:
  • frontend/package.json version
  • docker-compose.yml APP_VERSION
  • CHANGELOG.md with release notes
• GitHub Actions will auto-tag Docker images with the new version

Before merging to main:

• All tests passing
• PR reviewed and approved
• Branch is up to date with main
• No merge conflicts

Related issues