Import december-2020-12-18 from private repo (scrubbed 2026-05-27)

Targets Rec Room 2020.12.18 client.

Re-import after adding:
- DorkNet.ClientMod/dorknet-clientmod.json.template — config schema
  the launcher's manifest-driven patcher renders into UserData/.
- tools/build-patcher-zip.ps1 — produces the dorknet-clientpatch-{key}.zip
  Release asset the launcher fetches.
- .github/workflows/release.yml — auto-publishes both Release assets
  on v1-december-* tag push.

Scrubbed via maintainer-side scrub-for-public.ps1: same drop rules as
the prior import, plus build-patcher-zip.ps1 added to the tools/
allow-list so it survives the scrub.

DorkNet.Server/Controllers/API/QuickPlay/QuickPlayController.cs

@@ -0,0 +1,51 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using DorkNet.Server.Data;
+
+namespace DorkNet.Server.Controllers.API.QuickPlay;
+
+/// <summary>
+/// api.rec.net/api/quickPlay/* — the watch's "Quick Play" tile picks
+/// a popular open AG room when the player wants to jump in
+/// somewhere social without browsing.
+///
+/// • <c>GET v{1,2}/getandclear</c> — returns the next match the
+///   user was queued for, then clears it. We just synthesise a
+///   "join hot AG room" target on each call (no real queue).
+/// • <c>POST v1/set</c> — stores a desired-match tag. We log + ack;
+///   no persistence needed for a single-region private server.
+/// </summary>
+[ApiController]
+public class QuickPlayController(DorkNetDbContext db) : ControllerBase
+{
+    /// <summary>GET <c>v{1,2}/getandclear</c> — the watch polls this
+    /// on every connect / navigation to check whether the user has a
+    /// pending quickplay queue. Returning a real {RoomId, RoomName}
+    /// makes the client treat it as "you queued, go there now" and
+    /// immediately teleports — that's WHY users were randomly
+    /// spawning in Paddleball etc.
+    ///
+    /// Correct behaviour: return empty {} unless we actually have a
+    /// queued match for the caller. The /set endpoint is what
+    /// queues; getandclear is the consume.
+    ///
+    /// We don't persist queue state on a single-region private
+    /// server (no real matchmaking pool), so always return empty.</summary>
+    [HttpGet("api/quickPlay/v1/getandclear")]
+    [HttpGet("api/quickPlay/v2/getandclear")]
+    public IActionResult GetAndClear() => Ok(new { });
+
+    public sealed class SetQuickPlayRequest
+    {
+        public string? Tag { get; set; }
+    }
+
+    [HttpPost("api/quickPlay/v1/set")]
+    [Authorize]
+    public IActionResult Set([FromBody] SetQuickPlayRequest? req)
+    {
+        // Preference is per-session; we don't persist (no benefit in
+        // a small private deployment). Just ack.
+        return Ok(new { Tag = req?.Tag ?? string.Empty, Set = true });
+    }
+}