support for 202507 endpoints (#37)

* [auth][api] accept the 20250424.01 client

* [2025] unstable

* 20250718.0

* correct one this time

* stubs

* more stubs

* more stubs

* [lists] add worker

* [ai] route stubs

* [api] player photo setting

* [econ] add roomEconConfig route

* [infra] update worker generators

* [worker] add cards/moderation/platformnotification workers

* [lists] updates to some endpoints

* [clubs] stub out announcement endpoint, for now

* [econ] stub out season endpoints for now

* [chat] apps/chat stub out party endpoint not sure the shape yet

* [api] stub out statsig and lockeditems

* [doc] new services

* [lists] stub the bulk endpoint

* [datacollection] add placeholder service until we can kill it

* [api] set gifting to lvl5

* update lock

* [cdn] enable cache

* [match] matchmake v2

* [lists] stub some lists

* [ai] stubs

* [rooms] new subroom save endpoint

* [econ] add bulk purchase endpoint

* [discovery] update featured creator to 1 for fun

* [api] add photo settings flag

* [chat] fixup chat permissions (sorta)

* [auth] restrictions endpoint

* [rooms] contributed endpoint

* [api] fix outfit endpoint

* [discovery] attempt to fix store

* [chat] privacy endpoints

* [api] cheered images

* [rooms] add xp endpoint (disbaled)

* [rooms] add xp endpoint (disabled)

* update images-db for cheers

* [rooms] add autocomplete endpoint

* [cdn/img] increase cache ttl for statics

* [api] bulk route for images

* [accounts] add banner image

* [api] add misc missing endpoints

* [discovery] remove AI tab

* [platformnotifications] stub some endpoints

* [lists] add some more lists

* [rooms] additional endpoints

* [chat] stub a few privacy endpoints

* [econ] stub some endpoints

* misc db fixes

* [api] tweak shape for images v6

* [rooms] dont show trending RROs

.env.example

@@ -1,9 +1,22 @@
 # Base domain all service hosts are derived from, e.g. accounts.<domain>.
 RECFLARE_DOMAIN=rec.example.com
 
-# Optional per-app subdomain overrides, as a compact JSON object keyed by the
-# worker's directory name. Defaults to the directory name when unset.
-# RECFLARE_SUBDOMAINS='{"playersettings":"settings"}'
+# Optional per-service subdomain overrides, as a compact JSON object keyed by the
+# service's default subdomain (which, for a service backed by a worker, is that
+# worker's directory name). Unlisted services keep their default.
+#
+# One entry moves both sides: it decides which host `just deploy` puts the worker on
+# AND which host the `ns` discovery document advertises to the client, so the two can't
+# drift apart. Redeploy `ns` (`just deploy -F ns`) after changing this.
+#
+#   {"playersettings":"settings"}  the playersettings worker moves to settings.<domain>
+#   {"moderation":"api"}           Moderation has no worker of its own, so this is a pure
+#                                  client-side redirect: it points the client's Moderation
+#                                  calls at the api worker, which is where the
+#                                  /api/PlayerReporting/… routes actually live
+#
+# Keep it compact — no spaces. Services are listed in SERVICES.md.
+# RECFLARE_SUBDOMAINS='{"moderation":"api"}'
 
 # Id of the shared `recflare` D1 database (create it manually with
 # `wrangler d1 create recflare`). All D1-backed workers bind this one database.
@@ -85,6 +98,25 @@ RECFLARE_DOMAIN=rec.example.com
 # live instance, which is already in whichever room it was created in.
 # RECFLARE_ROOM_REDIRECTS=2=MyHub
 
+# The Photon applications the client connects to (`match`, GET /player/connection-info).
+# EMPTY unless you set them: recflare ships no Photon application, so until these name
+# yours the client is handed empty ids and connects to nothing. Create the three apps in
+# the Photon dashboard (Realtime, Voice, Chat) and paste their app ids here. They are not
+# secrets — the client is handed all three in the clear — which is why they are vars and
+# not Secrets Store entries.
+# RECFLARE_PHOTON_REALTIME_APP_ID=
+# RECFLARE_PHOTON_VOICE_APP_ID=
+# RECFLARE_PHOTON_CHAT_APP_ID=
+
+# The Photon region every session is pinned to (`match`). Unlike the app ids above this
+# does default, to `us` (us-east1) — an instance stamped with an empty region is one the
+# client cannot connect to, so there is no "unset" state for it to have. It is
+# named in the connection info AND stamped on every room instance, and one var feeds both:
+# the client authenticates against the app above and connects to the region on its
+# instance, so the two disagreeing is a session nobody can join. The QoS pings the client
+# reports are ranked but never acted on — one deployment runs in one region.
+# RECFLARE_PHOTON_REGION=us
+
 # RecCenterTokens a new player is granted, the first time their balance is read (`econ`).
 # 0 means players start broke. Applies only to players who haven't been granted yet —
 # raising it later does NOT top up existing players.