Add Next.js App Router API endpoints, auth, and game services

[Spbd1]

Motivation

• Provide a backend API in the web app to power participant/admin flows and tie the Prisma DB (packages/db) to the simulation engine (packages/engine).
• Enforce consistent request validation and API responses and implement a minimal MVP auth model so participants and admins can use the system safely.
• Implement critical server/game flows (join, submit decisions, start/resolve rounds, export) as typed service functions so the engine can be used and results persisted transactionally.

Description

• Added consistent API response helpers and error handling with ApiException and handleApiError, returning { ok, data?, error? } responses from routes (apps/web/lib/api/responses.ts).
• Added Zod request schemas for route params, join, decision submission, server create/update, and map generation (apps/web/lib/api/schemas.ts).
• Implemented minimal auth helpers: anonymous participant sessions via cookie, requireAdminAuth using Basic auth backed by ADMIN_EMAIL / ADMIN_PASSWORD, participant-server assertions, and cookie application (apps/web/lib/api/auth.ts).
• Implemented participant routes: POST /api/join-server, GET /api/me, GET /api/servers/available, GET /api/servers/:serverId/state, POST /api/servers/:serverId/decisions, GET /api/servers/:serverId/round-summary, POST /api/servers/:serverId/exit (files under apps/web/app/api/*).
• Implemented admin routes: GET|POST /api/admin/servers, GET|PATCH /api/admin/servers/:serverId, POST /api/admin/servers/:serverId/generate-map, POST /api/admin/servers/:serverId/start, POST /api/admin/servers/:serverId/resolve-round, POST /api/admin/servers/:serverId/archive, GET /api/admin/servers/:serverId/export, and GET /api/admin/analytics/overview.
• Added typed service layer for game logic and persistence: engine config normalization, map generation, joinWaitingServer, createServerMap, submitPlayerDecisions, startServer, and resolveActiveRound which calls resolveRound from packages/engine and persists updates in a Prisma transaction (apps/web/lib/services/game.ts).
• CSV export endpoint that collects players, parcels, decisions, contracts, server events, treasury transactions and round outcomes and returns CSV payloads (apps/web/app/api/admin/servers/[serverId]/export/route.ts).
• Wire @parcel-society/db, @parcel-society/engine, and zod into the web package and added a small tsconfig change to silence a TypeScript 7 baseUrl deprecation warning.

Testing

• Ran git diff --check locally and it passed with no whitespace errors.
• Attempted pnpm --filter @parcel-society/web typecheck, but it could not complete due to missing node_modules in the environment (TypeScript reported missing workspace package type declarations); the change includes type annotations and should typecheck once dependencies are installed.
• Attempted pnpm --filter @parcel-society/web lint, but it could not complete because dev dependencies (e.g. @eslint/js) were not available in the environment.
• Attempted pnpm --filter @parcel-society/web test, but it could not complete because vitest was not available in the environment.
• pnpm install --lockfile-only was attempted to update dependency lock data but was blocked by an external registry 403 for typescript-eslint in this environment; installing dependencies will allow the typecheck/lint/test steps to run successfully.

---

Codex Task