Import march-2020-03-10 from private repo (scrubbed 2026-05-27)

Targets Rec Room 2020.03.10 client (also serves 2020.03.06).

Re-import after adding:
- DorkNet.ClientMod/dorknet-clientmod.json.template — config schema
  the launcher's manifest-driven patcher renders into UserData/.
- tools/build-patcher-zip.ps1 — produces dorknet-clientpatch-{key}.zip
  for v1-march-* Release uploads.
- .github/workflows/release.yml — on tag push publishes both
  dorknet-server-march_2020_03_10-win-x64.zip and
  dorknet-clientpatch-march_2020_03_10.zip as Release assets.

Same scrub rules as december; tools/build-patcher-zip.ps1 added to
the maintainer-side allow-list so it survives.

DorkNet.Server/Controllers/Admin/AdminLoginController.cs

@@ -0,0 +1,54 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DorkNet.Server.Data;
+using DorkNet.Server.Services;
+
+namespace DorkNet.Server.Controllers.Admin;
+
+/// <summary>
+/// admin.rec.net/api/admin/v1/login — same-origin login endpoint for
+/// the browser-based admin UI. Wraps a username+password verify
+/// against PlayerEntity.PasswordHash and returns the JWT pair the UI
+/// can stash in localStorage. Refuses non-admin accounts up front so a
+/// regular player password can't be used to scope into the admin tools
+/// even if the JWT is valid against api/admin/v1/* (the AdminOnly
+/// filter would catch it anyway, but the early reject saves a
+/// confused-looking 403).
+///
+/// Lives on admin.rec.net so the static admin page (also served from
+/// admin.rec.net) can fetch with a same-origin request and skip CORS
+/// entirely.
+/// </summary>
+[ApiController]
+[Route("api/admin/v1")]
+public class AdminLoginController(
+    DorkNetDbContext db,
+    AuthService authService) : ControllerBase
+{
+    public sealed record AdminLoginRequest(string Username, string Password);
+
+    [HttpPost("login")]
+    public async Task<ActionResult> Login([FromBody] AdminLoginRequest body)
+    {
+        if (string.IsNullOrWhiteSpace(body.Username) || string.IsNullOrWhiteSpace(body.Password))
+            return BadRequest(new { error = "missing_credentials" });
+
+        var player = await db.Players.FirstOrDefaultAsync(p => p.Username == body.Username);
+        if (player is null || player.PasswordHash is null)
+            return Unauthorized(new { error = "invalid_credentials" });
+        if (!BCrypt.Net.BCrypt.Verify(body.Password, player.PasswordHash))
+            return Unauthorized(new { error = "invalid_credentials" });
+        if (!player.IsAdmin)
+            return StatusCode(403, new { error = "not_admin" });
+
+        var (access, refresh) = authService.GenerateTokenPair(player.Id);
+        return Ok(new
+        {
+            access_token = access,
+            refresh_token = refresh,
+            account_id = player.Id,
+            username = player.Username,
+            display_name = player.DisplayName,
+        });
+    }
+}