Import march-2020-03-10 from private repo (scrubbed 2026-05-27)

Targets Rec Room 2020.03.10 client (also serves 2020.03.06).

Re-import after adding:
- DorkNet.ClientMod/dorknet-clientmod.json.template — config schema
  the launcher's manifest-driven patcher renders into UserData/.
- tools/build-patcher-zip.ps1 — produces dorknet-clientpatch-{key}.zip
  for v1-march-* Release uploads.
- .github/workflows/release.yml — on tag push publishes both
  dorknet-server-march_2020_03_10-win-x64.zip and
  dorknet-clientpatch-march_2020_03_10.zip as Release assets.

Same scrub rules as december; tools/build-patcher-zip.ps1 added to
the maintainer-side allow-list so it survives.

DorkNet.Server/Controllers/PlayerSettings/PlayerSettingsController.cs

@@ -0,0 +1,65 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DorkNet.Server.Auth;
+using DorkNet.Server.Data;
+using DorkNet.Server.Data.Entities;
+using System.Text.Json.Serialization;
+
+namespace DorkNet.Server.Controllers.PlayerSettings;
+
+/// <summary>
+/// playersettings.rec.net — dedicated player settings service.
+/// </summary>
+[ApiController]
+[Authorize]
+public class PlayerSettingsController(DorkNetDbContext db) : ControllerBase
+{
+    private long CurrentPlayerId => this.RequireCurrentPlayerId();
+
+    [HttpGet("/settings/v1/{accountId:long}")]
+    public async Task<ActionResult<Dictionary<string, string>>> Get(long accountId)
+    {
+        // Settings are private — only the owner can read them. Returning
+        // 403 instead of leaking the dict.
+        if (accountId != CurrentPlayerId) return Forbid();
+
+        var settings = await db.PlayerSettings
+            .Where(s => s.PlayerId == accountId)
+            .ToDictionaryAsync(s => s.Key, s => s.Value);
+        return Ok(settings);
+    }
+
+    [HttpPut("/settings/v1/{accountId:long}")]
+    public async Task<IActionResult> Set(long accountId, [FromBody] Dictionary<string, string> updates)
+    {
+        if (accountId != CurrentPlayerId) return Forbid();
+
+        foreach (var (key, value) in updates)
+        {
+            var existing = await db.PlayerSettings
+                .FirstOrDefaultAsync(s => s.PlayerId == accountId && s.Key == key);
+            if (existing is null)
+                db.PlayerSettings.Add(new PlayerSettingEntity { PlayerId = accountId, Key = key, Value = value });
+            else
+                existing.Value = value;
+        }
+
+        await db.SaveChangesAsync();
+        return Ok();
+    }
+
+    [HttpDelete("/settings/v1/{accountId:long}/{key}")]
+    public async Task<IActionResult> Delete(long accountId, string key)
+    {
+        if (accountId != CurrentPlayerId) return Forbid();
+
+        var setting = await db.PlayerSettings
+            .FirstOrDefaultAsync(s => s.PlayerId == accountId && s.Key == key);
+        if (setting is null) return NotFound();
+
+        db.PlayerSettings.Remove(setting);
+        await db.SaveChangesAsync();
+        return Ok();
+    }
+}