feat: DorkNet.Quest, a sideload patcher for the 2023 Quest client

Patches the Quest build of Rec Room 2023.03.21 (20230317 / 2128210, the
same appVersion as the PC client) to connect to a DorkNet server, using
one native hook library loaded via DT_NEEDED on libmain.so.

- host rewrite onto <svc>.<ServerHost> or a {service}-dev.example.com template
- Photon app ids and region injection (PhotonRegion must match PC)
- TLS / pinning / image-signature bypass, integrity callbacks neutralised
- no-Meta-account build; the server treats platform id 0/1/blank as a
  placeholder and keys those accounts by device id
- build.ps1 -Obb packages a DorkNet-<ver>.xapk with one-command
  installers for Windows and macOS/Linux; app is named via AppName
- README, docs/quest.md and NOTICE updated; credits RecFlare and
  And64InlineHook (MIT)

Tested on a Quest 2: all hooks arm, requests reach the dev server.

docs/architecture.md

@@ -50,6 +50,7 @@ DorkNet.sln
 | `DorkNet.Services.Moderation` | Bug reporting, player reporting, sanitize, path-routed admin API, testcase routes | .NET 9 |
 | `DorkNet.Services.Web` | Public site, admin static host, same-origin admin browser API, feed static host, site API | .NET 9 |
 | `DorkNet.ClientMod` | MelonLoader 0.6.x IL2CPP mod — the client patcher, JSON config | .NET 6 |
+| `DorkNet.Quest` | native hook library + build scripts for the Meta Quest client | C++/arm64 |
 
 `ClientMod` applies the client-side patches needed to point the 2020
 watch at a DorkNet server: URI rewrite (`.rec.net` → configured apex),
@@ -59,6 +60,13 @@ MelonLoader 0.6.x and reads its settings from a JSON config under
 same config: Desktop Screen-Share FPS, RRO quest party size, and Rec
 Royale night mode (see the README and `recroom-2023-scene-moods.md`).
 
+`DorkNet.Quest` does the same jobs for the Meta Quest (Android/IL2CPP)
+2023.03.21 client, where there is no MelonLoader: one native library
+(`libdorknet.so`) is injected via a `DT_NEEDED` entry on `libmain.so`
+and installs arm64 inline hooks (host rewrite, Photon ids, TLS/pin and
+image-signature bypass, integrity-callback neutralisation). See
+[`quest.md`](quest.md).
+
 ---
 
 ## Server folder layout

docs/deploy.md

@@ -400,6 +400,18 @@ means losing post-cutover writes unless you migrate them back.
 
 ---
 
+## Meta Quest client
+
+DorkNet also serves a sideload-patched Rec Room 2023.03.21 **Quest** client
+(versionCode 2128210, appVersion `20230317` — the same version the PC client
+reports, so Quest and PC players share rooms). The same DNS/TLS/Photon/image-
+signing setup here serves it; the only Quest-specific server behaviour is the
+placeholder-platform-id handling in `PlayerService`. See [`quest.md`](quest.md)
+for the operator view and [`../DorkNet.Quest/README.md`](../DorkNet.Quest/README.md)
+for building and installing the patched APK.
+
+---
+
 ## Photon Cloud
 
 Use your own Photon AppIds. Rec Room's original Photon AppIds reject

docs/quest.md

@@ -0,0 +1,76 @@
+# Meta Quest client
+
+DorkNet can be played on a standalone Meta Quest headset using a
+sideload-patched Rec Room **2023.03.21** client. The patcher and the full build
+and install guide live in [`../DorkNet.Quest/`](../DorkNet.Quest/README.md);
+this page is the server operator's view.
+
+## Which build
+
+| | |
+| --- | --- |
+| Rec Room version | `2023.03.21` (versionName `20230317`, versionCode `2128210`) |
+| Package (store) | `com.AgainstGravity.RecRoom`, arm64-v8a, IL2CPP |
+| Ships | single APK + a ~1.4 GB OBB |
+
+This build reports appVersion **`20230317`** — identical to the PC
+`march-2023-03-21` client. The server hardcodes `"20230317"` in presence /
+match / notification responses, so **Quest and PC players interoperate with no
+server change**: the version gate (`GET api/versioncheck/v4`), the presence
+`appVersion` string, and Photon room versioning all line up. Do **not** patch a
+different Quest build (e.g. `20230414`) against this branch — a different
+appVersion reads as "version mismatch, can't join".
+
+## How it connects
+
+There is no MelonLoader on Android, so `DorkNet.Quest` does the ClientMod +
+Photon-byte-patch jobs with one native library (`libdorknet.so`) injected via a
+`DT_NEEDED` entry on `libmain.so`. At runtime it:
+
+- rewrites `<service>.rec.net` → `<service>.<ServerHost>` (for a server on
+  `Domain:HostStyle = hyphen`, set `ServerHost = {service}-<env>.<apex>`) (the name server then
+  hands out every other service URL — same bootstrap as the PC client);
+- injects the operator's Photon app ids and fixed region (`PhotonRegion`; it
+  must match the PC clients' `PhotonCloudRegion` or the two never meet);
+- accepts the self-hosted TLS chain and image signatures;
+- neutralises the integrity callbacks that would otherwise reject a re-signed,
+  hook-loaded sideload.
+
+So the **same DNS, TLS, Photon and image-signing setup from
+[`deploy.md`](deploy.md) serves Quest** — every `*.<apex>` subdomain the PC
+client uses must resolve and be covered by the cert.
+
+## Accounts without a Meta account
+
+If the build is made with a blank `OculusAppId` (the no-Meta-account build), the
+client can't produce a real Oculus platform identity, so **every headset sends
+the placeholder platform user id `1`**. The server must not treat that as an
+identity, or all those players collapse into one shared account and are offered
+each other's "remembered logins".
+
+DorkNet handles this server-side in `PlayerService`
+(`IsPlaceholderPlatformId`): platform ids `0`, blank and `1` are never stored on
+an account, never matched by the cached-login lookup
+(`cachedlogin/forplatformid`), and never used to synthesise a device id — those
+players are keyed by `deviceId` alone, exactly like the PC Steam-emulator path.
+A real Meta platform id (the Meta build) still tags and lists normally.
+
+Thanks to [RecFlare](https://github.com/recflare) for documenting this
+pitfall in their Quest client notes.
+
+> Covered by `DorkNet.Server.Tests/QuestPlaceholderPlatformIdTests.cs`. **Never
+> add a rule that accepts platform id `1` as a real identity** — the whole
+> no-Meta fleet sends the same value.
+
+## Operator checklist
+
+1. DNS + TLS for every `*.<apex>` service subdomain (see `deploy.md`).
+2. Your own Photon Realtime/Voice app ids (see `deploy.md` → Photon Cloud).
+3. Image signing key configured (`ImageSignatureService`), as for PC.
+4. Build with `ServerHost=<apex>`, the Photon ids and region baked in, passing
+   `-Obb` so you get a release folder (`DorkNet-<ver>.xapk` plus
+   `install.cmd`/`install.sh`). Players run the installer with the headset
+   plugged in; the app appears as **DorkNet** under Unknown Sources.
+
+No server component is Quest-specific beyond the placeholder-platform-id
+handling above.