fix: presence, profile edits, outfit menu and RecNetResult writes for the 2023 client

Every change below was checked against the 2023-03-21 client disassembly;
file:line evidence is in the code comments and in
docs/recroom-2023-client-api-complete.md.

Presence
- matchmake/none means "online, in no room" (its only caller is
  TryGoToOfflineRoom, which ignores the reply). The server used to keep the
  old room or invent a dorm, so the next heartbeat looked out of sync and
  the client cancelled its load to chase that room.
- The join watchdog no longer clears presence 30 s into a long room load;
  it is a 3 minute backstop that drops the room only.
- One fan-out (PresenceBroadcastService) for every transition: deferred
  joins, matchmake/none, logout, failed joins, visibility changes, SignalR
  connect/disconnect. isOnline is sent on its own; pushes never go to the
  subject, because a self push moves the player.
- Online-status visibility (Public / Friends / Favorites / Appear offline)
  is stored and honoured by GET /player and by the live pushes.

Profile
- PUT account/me/{emoji,personalpronouns,identityflags,bannerimage} were
  404; added with the client's real form keys and persisted (new Players
  columns plus migration). Every account read now returns them, and edits
  push AccountUpdate to everyone.

Outfit menu
- Saved outfits kept OutfitSelectionsV2 and CustomAvatarItems, so loading a
  slot restores what was saved instead of a stale outfit.
- isCreationAllowedForAccount answers the {Success, Error} envelope the
  client parses; minPriceForPublicItem is a bare int; gifts/generate accepts
  form bodies; lockeditems returns the full owned-item shape; colourways no
  longer share their base item's AvatarItemId.

RecNetResult writes
- About 40 writes look status-only but parse the body as {Success, Error}.
  An empty 200 showed "Failed to ..." after the server applied the change,
  and a body without Success threw "Error message cannot be null". Clubs,
  announcements, keepsakes, comments/read, subscriptions, purchase offers
  and privacy settings now answer RecNetResult.
- Login token and device-code grants are real; remoteauth approves the
  device code; createlogintoken returns a bare string.
- New: incentivizedreferrals/referrals, account/bulk/{email,phone},
  GET strings, account/me/confirmphone, PlayMenuCarouselOrdering_1.
  Route inventory and coverage test extended to match.

README now describes the 2023 branch.

DorkNet.Server/Controllers/API/IncentivizedReferrals/IncentivizedReferralsController.cs

@@ -34,6 +34,58 @@ public class IncentivizedReferralsController(DorkNetDbContext db, LevelService l
         });
     }
 
+    /// <summary>The caller's referred players, paged.
+    ///
+    /// <c>FGLDKEJLAKB&lt;GPJIMAHMAIO&gt; EGEEFJHAGAM(Int32? take, String continuationToken)</c>
+    /// (RecNet.Runtime/LINKIECPDML.txt:337) builds this through the URL builder
+    /// LPPEFJMCJFN ("api/incentivizedreferrals/" + "referrals", :677-701, with
+    /// <c>take</c> and <c>continuationToken</c> query params at :716/:737) — which
+    /// is why the plain route-literal sweep never saw it — and issues a GET
+    /// (:164-170). Reply formatter KOEEACLMAFE.txt:203-238:
+    /// <c>{Referrals: [...], ContinuationToken: string}</c>; each entry
+    /// (ADAFNGNADFH.txt:279-346) is <c>{InviteeAccountId: Int32, CreatedAt:
+    /// DateTime, VerifiedAt: DateTime?}</c>.
+    ///
+    /// A referral is recorded when a brand-new player redeems the caller's
+    /// referral code (LinkController.CreditReferralAsync), and that redemption
+    /// is what counts it, so it is verified at the moment it is created. The
+    /// continuation token is the next offset; null once the list is exhausted.</summary>
+    [HttpGet("referrals")]
+    public async Task<IActionResult> Referrals([FromQuery] int? take, [FromQuery] string? continuationToken)
+    {
+        var size = Math.Clamp(take ?? 20, 1, 100);
+        var offset = int.TryParse(continuationToken, out var parsed) && parsed > 0 ? parsed : 0;
+        var prefix = $"referral:credited:{Me}:";
+
+        var rows = await db.PlayerSettings
+            .Where(s => s.Key.StartsWith(prefix))
+            .OrderByDescending(s => s.Id)
+            .Skip(offset)
+            .Take(size + 1)
+            .Select(s => new { s.PlayerId, s.Value })
+            .ToListAsync();
+
+        var page = rows.Take(size).Select(r =>
+        {
+            var at = DateTime.TryParse(r.Value, null,
+                System.Globalization.DateTimeStyles.RoundtripKind, out var credited)
+                ? credited
+                : DateTime.UnixEpoch;
+            return new
+            {
+                InviteeAccountId = (int)r.PlayerId,
+                CreatedAt = at,
+                VerifiedAt = (DateTime?)at,
+            };
+        }).ToList();
+
+        return Ok(new
+        {
+            Referrals = page,
+            ContinuationToken = rows.Count > size ? (offset + size).ToString() : null,
+        });
+    }
+
     // Client contract: the claim response deserializes as a top-level
     // List<RewardSelection> where each entry is
     // { rewardSelectionId: long, rewardType: string } (RecNet.Runtime