fix: correct 2023-03-21 client wire contracts across the API and notify surfaces

Audits every route the March-2023 client can call against what this server
actually serves, and fixes the defects that were breaking gameplay. Adds
docs/recroom-2023-client-api-complete.md as the reference: ~500 route
literals across 13 subsystems, with verb, request/response shape, and a
per-subsystem diff. 315 defects catalogued; the ones fixed here are listed
in its "Already fixed" table.

Path coverage was never the problem — 465 of 506 routes already had
handlers. The failures were in shape, and they cluster into four causes:

- Wrong verb. The verb is a BestHTTP.HTTPMethods ordinal (GET=0 .. PATCH=5),
  confirmed from that enum's static constructor. Routes registered POST-only
  while the client PUTs returned 405, which made room consumables neither
  buyable nor consumable and blocked every room-key edit.
- Bare scalar wrapped in an object. The client reads `1000`, not
  `{"Limit":1000}`; the issuing method signature says which. Wrapping makes
  the deserializer throw and the feature dies silently.
- [FromBody] vs form-urlencoded. The client sends nearly every write as form
  data, which an [ApiController] action bound [FromBody] rejects with 415
  before the handler runs. This alone broke all 13 club member-management
  endpoints. Adds Binding/FormOrJsonModelBinder so this is fixed once.
- Notify dispatch keys. Both enum overloads of the client's RegisterHandler
  lower the id via Int32.ToString() and register only that numeric key, and
  lookup is a case-sensitive TryGetValue that returns silently on a miss. We
  were sending the enum NAME for most ids, so friend-request updates, forced
  logout, maintenance broadcasts, live balance and consumable updates, and
  invention moderation pushes all evaporated with no error anywhere.

Notable behavioural bugs fixed:

- Editing a club announcement deleted it: PUT was a third binding on the
  delete handler. Split apart, and the missing create route added.
- leaderboard/CheckAndSetStat did not exist. The 2023 client has no SetStat
  literal at all, so every leaderboard score it wrote was discarded.
- Setting a club clubhouse cleared it: the handler read roomId from the query
  while the client sends it in the body, then wrote the resulting null.
- Club join requests were inverted (the enum is Open=0, InviteOnly=1,
  AskToJoin=2), so ask-to-join clubs rejected everyone and invite-only clubs
  quietly admitted them.
- Room bans were pushed as id 24, for which the client registers no handler;
  they now go out as ModerationKick with IsBan, so the ban takes effect
  immediately instead of at next login.
- Room-key ownership queries answered for the wrong player, and "has anyone
  bought this key" asked "did I buy it" — always false for the creator.

Also persists settings that were previously acknowledged and dropped
(playlist accessibility/restrictions/level-voting/warning, per-player status
visibility, VR movement mode and avoid-juniors, custom room codes), which is
what the new columns in the migration are for.

One test asserted the old nested PriceAndCurrency response shape; the
client's consumable formatter has no such key and reads Price and
PurchaseCurrencyId flat, so the test was corrected alongside the handler.

DorkNet.Server/Controllers/API/Moderation/InGameModerationController.cs

@@ -1,3 +1,4 @@
+using System.Text.Json;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
@@ -105,9 +106,23 @@ public class InGameModerationController(
 
     // ── /v1/instantKick — admin one-shot ─────────────────────────────
     /// <summary>
-    /// Admin/dev one-shot kick. The watch posts either
+    /// Admin/dev one-shot kick. The 2020.12 watch posts either
     /// <c>?playerId=N</c> for a single target (PlayerReporting.txt:3417)
-    /// or a list body for bulk kicks (3590). Either form lands here.
+    /// or a list body for bulk kicks (3590).
+    ///
+    /// The 2023-03-21 client posts neither: it serialises a
+    /// <c>RecNet.KickPlayerDTO</c> with <c>JsonUtility.ToJson</c> and sends it
+    /// as a RAW JSON body (RecNet.Runtime/FPIBGPIAOBI.txt:5012 JsonUtility.ToJson,
+    /// :5018 BNDIAONDFFF.FJLLPHFOOJJ raw-body setter, :5034 verb rdx=2).
+    /// KickPlayerDTO's fields are not obfuscated — <c>public long GameSessionId</c>
+    /// and <c>public List&lt;int&gt; PlayerIds</c> — so the body is exactly
+    /// <c>{"GameSessionId":123,"PlayerIds":[456]}</c>. Unity's JsonUtility emits
+    /// field names verbatim.
+    ///
+    /// None of the query/form parameters bound against that body, so the target
+    /// list came back empty and every 2023 instant-kick returned
+    /// "missing_target" and kicked nobody.
+    ///
     /// Gated to <see cref="PlayerEntity.IsAdmin"/> /
     /// <see cref="PlayerEntity.IsDeveloper"/>.
     /// </summary>
@@ -130,6 +145,7 @@ public class InGameModerationController(
             foreach (var part in formIds.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
                 if (long.TryParse(part, out var v) && v > 0) ids.Add(v);
         }
+        ids.AddRange(await ReadKickPlayerDtoIdsAsync());
         ids = ids.Distinct().ToList();
         if (ids.Count == 0) return Ok(new { success = false, error = "missing_target" });
 
@@ -143,6 +159,47 @@ public class InGameModerationController(
         return Ok(new { success = true, error = "" });
     }
 
+    /// <summary>Read the 2023 client's raw <c>KickPlayerDTO</c> JSON body.
+    /// Returns an empty list for a form post or an unparseable body so the
+    /// older query/form paths are unaffected.</summary>
+    private async Task<List<long>> ReadKickPlayerDtoIdsAsync()
+    {
+        var ids = new List<long>();
+        if (Request.HasFormContentType) return ids;
+
+        try
+        {
+            Request.EnableBuffering();
+            Request.Body.Position = 0;
+            using var doc = await JsonDocument.ParseAsync(Request.Body);
+            Request.Body.Position = 0;
+            if (doc.RootElement.ValueKind != JsonValueKind.Object) return ids;
+
+            foreach (var name in new[] { "PlayerIds", "playerIds" })
+            {
+                if (!doc.RootElement.TryGetProperty(name, out var arr) ||
+                    arr.ValueKind != JsonValueKind.Array) continue;
+                foreach (var el in arr.EnumerateArray())
+                    if (el.ValueKind == JsonValueKind.Number && el.TryGetInt64(out var v) && v > 0)
+                        ids.Add(v);
+                break;
+            }
+
+            foreach (var name in new[] { "PlayerId", "playerId" })
+            {
+                if (doc.RootElement.TryGetProperty(name, out var one) &&
+                    one.ValueKind == JsonValueKind.Number &&
+                    one.TryGetInt64(out var v) && v > 0)
+                {
+                    ids.Add(v);
+                    break;
+                }
+            }
+        }
+        catch (JsonException) { /* not a JSON body */ }
+        return ids;
+    }
+
     // ── /v1/deviceId — log mismatched device id ──────────────────────
     [HttpPost("api/PlayerReporting/v1/deviceId")]
     [Consumes("application/x-www-form-urlencoded", "multipart/form-data", "application/json")]
@@ -192,11 +249,21 @@ public class InGameModerationController(
             "[mod] ban by {Caller}: target={Target} reason={Reason} until={Until} display={Display}",
             caller, target, reason, p.BannedUntil, displayReason);
 
-        // Push a ModerationRoomBan notification so the target watch
-        // shows the ban dialog and disconnects (PlayerReporting.txt:2253).
-        await notifications.NotifyAsync(
+        // Push the ban as a ModerationKick (22) with IsBan set, NOT as
+        // ModerationRoomBan (24): the 2023-03-21 client's moderation manager
+        // registers only 22, "ModerationUnkick" and 23
+        // (RecNet.Runtime/FPIBGPIAOBI.txt:310, :323, :335) — there is no handler
+        // for 24, so that push landed nowhere and the banned player kept playing
+        // until their next login. The 22 handler reads Msg.Reason as a
+        // ModerationBlockDetail, which ModerationKickPayload already produces.
+        await notifications.KickPlayerAsync(
             target,
-            Models.Notification.PushNotificationId.ModerationRoomBan);
+            // `reason` is the numeric report category; DisplayReason is the
+            // moderator's text and is what the ban dialog shows.
+            string.IsNullOrWhiteSpace(displayReason)
+                ? "You have been banned from this room."
+                : displayReason.Trim(),
+            isBan: true);
         return Ok(new { success = true, error = "" });
     }