0.8.0.12:0 — bundle Station Master v0.8.0.12, and a Restore a Seat action

A player who has lost their browser storage can be put back in their seat
(Gitea#33 in the game repo). The session token is the only identity the game
has and it lives in one browser's localStorage, scoped to the origin joined at,
so a cleared profile, a private window or a different browser locks a player
out of a game that is still running with their session still on disk. Seen at a
real table: of two humans in one game, the host reloaded straight back in and
the joiner met an empty lobby.

New action, restore-seat: pick a seat from a dropdown of the players actually
holding a session — bots never appear, since seatedPlayers is read from the
server's session map rather than guessed from display names — and get back a
link built from this interface's own address. serverApi gained mintClaim; the
dictionary gained 57-64 in all five locales.

THE LINK CARRIES A CODE, NOT THE TOKEN. lobby-and-sessions.md §1 says to keep
the token out of URLs so it is not shoulder-surfed or pasted into a chat, and a
recovery link is exactly what gets pasted into a chat. The code is single-use,
expires in 30 minutes, and the page trades it for the real token over a POST.
Minting is admin-gated because deciding that somebody has lost a seat is a
judgement no route can make safely; spending needs no secret, because the
player following the link holds none.

GAMES IN PROGRESS RESUME NORMALLY, measured rather than assumed:
`git diff v0.8.0.11..v0.8.0.12 -- src/engine/` is EMPTY. The release is the
server's HTTP surface, the client and the docs. The codes live in memory and
are deliberately not persisted, so nothing new reaches the volume and there is
nothing to migrate. README, instructions.md and the release notes in all five
locales say so.

NOT YET EXERCISED END TO END: the two routes and the action are typechecked and
the claim store is unit-tested, but nothing has run them against a live server.
This build is what makes that possible.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017nnuCv8UodHucFfx3LWEoX

startos/serverApi.ts

@@ -21,6 +21,11 @@ export type GameRow = {
   playerCount: number
   playerNames: string[]
   createdAt: number
+  /**
+   * The seats a HUMAN holds a session token for — absent on a lobby. Bots never appear: the server
+   * reads this from its session map rather than guessing from `playerNames` (Gitea#33).
+   */
+  seatedPlayers?: number[]
   // Absent on a lobby — it has no game to be part-way through.
   lastMoveAt?: number
   status?: 'active' | 'finished'
@@ -96,3 +101,34 @@ export async function deleteGame(
   })
   return (await res.json()) as { gameCode: string | null; save: unknown }
 }
+
+/**
+ * Mint a one-time code that puts one player back into their seat — Gitea#33.
+ *
+ * A session token is the only identity the game has, and it lives in one browser's local storage.
+ * Lose it and the seat is unreachable: nothing else on the server will accept a claim to it. So the
+ * administrator mints a code for a named seat, and the player opens a link carrying it.
+ *
+ * THE CODE IS NOT THE TOKEN. The game's own `lobby-and-sessions.md` §1 says to keep the token out of
+ * URLs, and this code is going into one — so it is short-lived, single-use, and exchanged for the
+ * real token by the page over a POST. `Content-Type` is set here because `adminFetch` spreads these
+ * headers alongside the admin secret rather than assuming a body.
+ */
+export async function mintClaim(
+  effects: T.Effects,
+  gameId: string,
+  player: number,
+): Promise<{ code: string; expiresAt: number; player: number; displayName: string; gameCode: string | null }> {
+  const res = await adminFetch(effects, `/api/games/${gameId}/claim`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ player }),
+  })
+  return (await res.json()) as {
+    code: string
+    expiresAt: number
+    player: number
+    displayName: string
+    gameCode: string | null
+  }
+}