Import march-2020-03-10 from private repo (scrubbed 2026-05-27)

Targets Rec Room 2020.03.10 client (also serves 2020.03.06).

Re-import after adding:
- DorkNet.ClientMod/dorknet-clientmod.json.template — config schema
  the launcher's manifest-driven patcher renders into UserData/.
- tools/build-patcher-zip.ps1 — produces dorknet-clientpatch-{key}.zip
  for v1-march-* Release uploads.
- .github/workflows/release.yml — on tag push publishes both
  dorknet-server-march_2020_03_10-win-x64.zip and
  dorknet-clientpatch-march_2020_03_10.zip as Release assets.

Same scrub rules as december; tools/build-patcher-zip.ps1 added to
the maintainer-side allow-list so it survives.

DorkNet.Server/Auth/BanCheckMiddleware.cs

@@ -0,0 +1,55 @@
+using Microsoft.EntityFrameworkCore;
+using DorkNet.Server.Data;
+using System.Security.Claims;
+using System.Text.Json;
+
+namespace DorkNet.Server.Auth;
+
+/// <summary>
+/// Short-circuits any authenticated request whose JWT-resolved player has
+/// a non-null <c>BannedUntil</c> in the future. Sits AFTER
+/// <c>UseAuthentication</c>/<c>UseAuthorization</c> in the pipeline so the
+/// claims principal is populated before we look at it.
+///
+/// Anonymous requests (no/invalid bearer) pass through unchanged — this
+/// middleware never short-circuits them. Whether they're allowed is the
+/// per-endpoint <c>[Authorize]</c> decision, not ours.
+///
+/// Lookup is one query per request against the Players table. Cached for
+/// the request lifetime via the scoped DbContext, so repeated bearer
+/// checks within one request hit the EF first-level cache.
+/// </summary>
+public class BanCheckMiddleware(RequestDelegate next)
+{
+    public async Task InvokeAsync(HttpContext ctx, DorkNetDbContext db)
+    {
+        // Cheap early-out for anonymous traffic — no DB hit.
+        var sub = ctx.User.FindFirstValue(ClaimTypes.NameIdentifier);
+        if (!long.TryParse(sub, out var playerId))
+        {
+            await next(ctx);
+            return;
+        }
+
+        // Project just the BannedUntil column — no need to materialise the
+        // full player entity for every request.
+        var bannedUntil = await db.Players
+            .Where(p => p.Id == playerId)
+            .Select(p => p.BannedUntil)
+            .FirstOrDefaultAsync();
+
+        if (bannedUntil.HasValue && bannedUntil.Value > DateTime.UtcNow)
+        {
+            ctx.Response.StatusCode = StatusCodes.Status401Unauthorized;
+            ctx.Response.ContentType = "application/json";
+            await ctx.Response.WriteAsync(JsonSerializer.Serialize(new
+            {
+                Error = "banned",
+                Until = bannedUntil.Value.ToString("o"),
+            }));
+            return;
+        }
+
+        await next(ctx);
+    }
+}