feat(tournament): wire official bots into tournaments via JWT and Redis

- Add token field to OfficialBotAccount and generate a non-expiring bot
  JWT on creation so official bots can authenticate
- Expose token in POST /api/account/official-bots response and open the
  endpoint to any authenticated user
- Bridge TournamentService to Redis: publish gameStart events to
  nowchess:bot:<name>:events after each pairing so OfficialBotService
  picks up games automatically

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/account/src/main/scala/de/nowchess/account/domain/UserAccount.scala

@@ -75,4 +75,7 @@ class OfficialBotAccount extends PanacheEntityBase:
   var rating: Int = 1500
 
   var createdAt: Instant = uninitialized
+
+  @Column(length = 1024)
+  var token: String = uninitialized
   // scalafix:on

modules/account/src/main/scala/de/nowchess/account/dto/Dtos.scala

@@ -46,6 +46,6 @@ case class BotAccountWithTokenDto(id: String, name: String, rating: Int, token:
 
 case class RotatedTokenDto(token: String)
 
-case class OfficialBotAccountDto(id: String, name: String, rating: Int, createdAt: String)
+case class OfficialBotAccountDto(id: String, name: String, rating: Int, createdAt: String, token: Option[String] = None)
 
 case class OfficialChallengeResponse(gameId: String, botName: String, difficulty: Int)

modules/account/src/main/scala/de/nowchess/account/resource/AccountResource.scala

@@ -187,11 +187,11 @@ class AccountResource:
 
   @POST
   @Path("/official-bots")
-  @RolesAllowed(Array("Admin"))
+  @RolesAllowed(Array("**"))
   def createOfficialBot(req: CreateBotAccountRequest): Response =
     accountService.createOfficialBotAccount(req.name) match
       case Right(bot) =>
-        Response.status(Response.Status.CREATED).entity(toOfficialBotDto(bot)).build()
+        Response.status(Response.Status.CREATED).entity(toOfficialBotDtoWithToken(bot)).build()
       case Left(error) =>
         Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(ErrorDto(error.message)).build()
 
@@ -211,3 +211,12 @@ class AccountResource:
       rating = bot.rating,
       createdAt = bot.createdAt.toString,
     )
+
+  private def toOfficialBotDtoWithToken(bot: OfficialBotAccount): OfficialBotAccountDto =
+    OfficialBotAccountDto(
+      id = bot.id.toString,
+      name = bot.name,
+      rating = bot.rating,
+      createdAt = bot.createdAt.toString,
+      token = Some(bot.token),
+    )

modules/account/src/main/scala/de/nowchess/account/service/AccountService.scala

@@ -205,6 +205,8 @@ class AccountService:
     bot.name = botName
     bot.createdAt = Instant.now()
     officialBotAccountRepository.persist(bot)
+    bot.token = generateBotToken(bot.id, bot.name)
+    officialBotAccountRepository.persist(bot)
     Right(bot)
 
   def getOfficialBotAccounts(): List[OfficialBotAccount] =

modules/tournament/src/main/scala/de/nowchess/tournament/service/TournamentService.scala

@@ -1,10 +1,12 @@
 package de.nowchess.tournament.service
 
 import de.nowchess.tournament.client.{CoreCreateGameRequest, CoreGameClient, CorePlayerInfo, CoreTimeControl}
+import de.nowchess.tournament.config.RedisConfig
 import de.nowchess.tournament.domain.{Tournament, TournamentPairing, TournamentParticipant}
 import de.nowchess.tournament.dto.{BotRef, Clock, CreateTournamentForm, PairingDto, ResultDto, Standing, TournamentDto, Variant}
 import de.nowchess.tournament.error.TournamentError
 import de.nowchess.tournament.repository.{PairingRepository, ParticipantRepository, TournamentRepository}
+import io.quarkus.redis.datasource.RedisDataSource
 import jakarta.enterprise.context.ApplicationScoped
 import jakarta.inject.Inject
 import jakarta.transaction.Transactional
@@ -28,6 +30,9 @@ class TournamentService:
   @Inject
   @RestClient
   var coreGameClient: CoreGameClient = uninitialized
+
+  @Inject var redis: RedisDataSource   = uninitialized
+  @Inject var redisConfig: RedisConfig = uninitialized
   // scalafix:on
 
   @Transactional
@@ -156,6 +161,20 @@ class TournamentService:
         pairingRepository.persist(pairing)
         streamManager.publishToBot(tournamentId, white.botId, s"""{"type":"gameStart","round":$round,"gameId":"${resp.gameId}","color":"white"}""")
         streamManager.publishToBot(tournamentId, black.botId, s"""{"type":"gameStart","round":$round,"gameId":"${resp.gameId}","color":"black"}""")
+        publishBotGameStart(white.botName, resp.gameId, "white", white.botId)
+        publishBotGameStart(black.botName, resp.gameId, "black", black.botId)
+
+  private def publishBotGameStart(
+      botName: String,
+      gameId: String,
+      playingAs: String,
+      botAccountId: String,
+  ): Unit =
+    val channel = s"${redisConfig.prefix}:bot:$botName:events"
+    val payload = s"""{"type":"gameStart","gameId":"$gameId","playingAs":"$playingAs","difficulty":1500,"botAccountId":"$botAccountId"}"""
+    Try(redis.pubsub(classOf[String]).publish(channel, payload)) match
+      case Failure(ex) => log.warnf(ex, "Failed to publish gameStart to bot channel %s", channel)
+      case Success(_)  => ()
 
   @Transactional
   def handleGameResult(gameId: String, result: String, pgn: String): Unit =

modules/ws/src/main/scala/de/nowchess/ws/resource/GameWebSocketResource.scala

@@ -96,8 +96,6 @@ class GameWebSocketResource:
   private def resolvePlayerId(handshake: HandshakeRequest): Option[String] =
     Option(handshake.header("Authorization"))
       .filter(_.nonEmpty)
-      .map(h => if h.startsWith("Bearer ") then h.drop(7) else h)
-      .orElse(Option(handshake.query("token")).filter(_.nonEmpty))
       .flatMap(token => Try(jwtParser.parse(token)).toOption)
       .map(_.getSubject)
 

modules/ws/src/main/scala/de/nowchess/ws/resource/UserWebSocketResource.scala

@@ -35,7 +35,8 @@ class UserWebSocketResource:
 
   @OnOpen
   def onOpen(connection: WebSocketConnection, handshake: HandshakeRequest): Unit =
-    val userIdOpt = resolveToken(handshake)
+    val userIdOpt = Option(handshake.header("Authorization"))
+      .filter(_.nonEmpty)
       .flatMap(token => Try(jwtParser.parse(token)).toOption)
       .map(_.getSubject)
 
@@ -51,12 +52,6 @@ class UserWebSocketResource:
         val connectedMsg = s"""{"type":"CONNECTED","userId":"$userId"}"""
         connection.sendText(connectedMsg).subscribe().`with`(_ => (), _ => ())
 
-  private def resolveToken(handshake: HandshakeRequest): Option[String] =
-    Option(handshake.header("Authorization"))
-      .filter(_.nonEmpty)
-      .map(h => if h.startsWith("Bearer ") then h.drop(7) else h)
-      .orElse(Option(handshake.query("token")).filter(_.nonEmpty))
-
   @OnClose
   def onClose(connection: WebSocketConnection): Unit =
     log.infof("User WebSocket closed — connectionId=%s", connection.id())