fix: presence, profile edits, outfit menu and RecNetResult writes for the 2023 client

Every change below was checked against the 2023-03-21 client disassembly;
file:line evidence is in the code comments and in
docs/recroom-2023-client-api-complete.md.

Presence
- matchmake/none means "online, in no room" (its only caller is
  TryGoToOfflineRoom, which ignores the reply). The server used to keep the
  old room or invent a dorm, so the next heartbeat looked out of sync and
  the client cancelled its load to chase that room.
- The join watchdog no longer clears presence 30 s into a long room load;
  it is a 3 minute backstop that drops the room only.
- One fan-out (PresenceBroadcastService) for every transition: deferred
  joins, matchmake/none, logout, failed joins, visibility changes, SignalR
  connect/disconnect. isOnline is sent on its own; pushes never go to the
  subject, because a self push moves the player.
- Online-status visibility (Public / Friends / Favorites / Appear offline)
  is stored and honoured by GET /player and by the live pushes.

Profile
- PUT account/me/{emoji,personalpronouns,identityflags,bannerimage} were
  404; added with the client's real form keys and persisted (new Players
  columns plus migration). Every account read now returns them, and edits
  push AccountUpdate to everyone.

Outfit menu
- Saved outfits kept OutfitSelectionsV2 and CustomAvatarItems, so loading a
  slot restores what was saved instead of a stale outfit.
- isCreationAllowedForAccount answers the {Success, Error} envelope the
  client parses; minPriceForPublicItem is a bare int; gifts/generate accepts
  form bodies; lockeditems returns the full owned-item shape; colourways no
  longer share their base item's AvatarItemId.

RecNetResult writes
- About 40 writes look status-only but parse the body as {Success, Error}.
  An empty 200 showed "Failed to ..." after the server applied the change,
  and a body without Success threw "Error message cannot be null". Clubs,
  announcements, keepsakes, comments/read, subscriptions, purchase offers
  and privacy settings now answer RecNetResult.
- Login token and device-code grants are real; remoteauth approves the
  device code; createlogintoken returns a bare string.
- New: incentivizedreferrals/referrals, account/bulk/{email,phone},
  GET strings, account/me/confirmphone, PlayMenuCarouselOrdering_1.
  Route inventory and coverage test extended to match.

README now describes the 2023 branch.

DorkNet.Server/Controllers/API/PlayerEvents/PlayerEventsController.cs

@@ -1145,10 +1145,17 @@ public class PlayerEventsController(
         extras.SupportMultiInstanceRoomChat =
             await ReadBoolFieldAsync("supportsMultiInstanceRoomChat", "supportMultiInstanceRoomChat",
                 "SupportMultiInstanceRoomChat") ?? false;
-        extras.DefaultBroadcastPermissions =
-            await ReadIntFieldAsync("defaultBroadcastPermissions", "DefaultBroadcastPermissions") ?? 0;
-        extras.CanRequestBroadcastPermissions =
-            await ReadIntFieldAsync("canRequestBroadcastPermissions", "CanRequestBroadcastPermissions") ?? 0;
+        // These two are boxed enums (typeof(AKFCIMLMAKA) at
+        // CBKANFIOBCF_NestedType_EONGJBMLEFO.txt:117-165), and a boxed non-string
+        // field goes through Object.ToString (BNDIAONDFFF.txt:947, ISIL 107-110),
+        // so they arrive as member NAMES. int.TryParse failed on every one and
+        // the settings were always stored as 0.
+        extras.DefaultBroadcastPermissions = ParseBroadcastPermissions(
+            await ReadStringFieldAsync("defaultBroadcastPermissions", "DefaultBroadcastPermissions"))
+            ?? extras.DefaultBroadcastPermissions;
+        extras.CanRequestBroadcastPermissions = ParseBroadcastPermissions(
+            await ReadStringFieldAsync("canRequestBroadcastPermissions", "CanRequestBroadcastPermissions"))
+            ?? extras.CanRequestBroadcastPermissions;
 
         await SaveExtrasAsync(evt, extras);
         return Ok(await WrapperAsync(evt));
@@ -1437,6 +1444,33 @@ public class PlayerEventsController(
             : null;
     }
 
+    /// <summary>Broadcast-permission mode as a number. Members per the
+    /// 2023.06.21 dump (enum KJJFEBEMPKM, mapped by
+    /// EventsConfig.BroadcastPermissionsModeFriendlyNameMapping): None = 0,
+    /// RoomOwners = 256, All = Int32.MaxValue. Accepts the number itself (JSON
+    /// bodies send numbers), a member name, or a comma-joined flags string.
+    /// Null when the value is absent or unrecognised, so the stored setting is
+    /// kept rather than silently zeroed.</summary>
+    public static int? ParseBroadcastPermissions(string? raw)
+    {
+        if (string.IsNullOrWhiteSpace(raw)) return null;
+        if (int.TryParse(raw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var n)) return n;
+        var total = 0;
+        foreach (var part in raw.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+        {
+            int? value = part.ToLowerInvariant() switch
+            {
+                "none" => 0,
+                "roomowners" => 256,
+                "all" => int.MaxValue,
+                _ => null,
+            };
+            if (value is null) return null;
+            total |= value.Value;
+        }
+        return total;
+    }
+
     private async Task<int?> ReadIntFieldAsync(params string[] names)
     {
         var value = await ReadStringFieldAsync(names);