feat: Steam integration, fire-and-forget wizard, self-healing watchdog

Steam integration (Zig + shell):
- src/interface/ffi/src/steam_client.zig: Steam Web API client
  - resolveVanityUrl() → Steam64 ID via ISteamUser/ResolveVanityURL
  - getPlayerSummary() → display name, profile URL, visibility
  - checkOwnership() → verify account owns an AppID
  - 3 exported C ABI functions + 5 unit tests
  - Integrated into main.zig (comptime linker hints) + cli.zig subcommand
- scripts/steam-stage.sh: SteamCMD authenticated download + volume sync
  - Installs SteamCMD if absent, auth token persistence (avoids Steam Guard repeats)
  - Interactive Steam Guard prompt on first login
  - Rsync to local volume or remote host (Verpex VPS)
  - AppID 1200170 (CryoFall dedicated server requires owned account)

Fire-and-forget wizard:
- scripts/wizard.sh: 7-step interactive + --unattended provisioning
  1. Game selection  2. Steam ID resolution  3. Settings.xml config
  4. Game file staging  5. Provision  6. Probe  7. Report
- gsa steam resolve <vanity>: resolve Steam username → Steam64 ID from CLI
- gsa steam player <id>: fetch player display name and profile URL

Self-healing watchdog:
- scripts/self-heal.sh: continuous health monitor with auto-recovery
  - Container status, UDP port binding, disk space, Settings.xml integrity
  - Escalating recovery: podman start → systemctl restart → Groove alert
  - Max restart threshold before DEGRADED + alert
  - VeriSimDB-backed Settings.xml restore on corruption
- Justfile: cryofall-watchdog, cryofall-watchdog-install (systemd user service)

Justfile additions:
- wizard, wizard-auto, cryofall-stage, cryofall-stage-verpex, steam-resolve
- All new scripts marked executable

DNS: cryofall.jewell.nexus → 209.42.26.106 grey-cloud (live in Cloudflare)
Firewall: UDP 6000+6001 open on Verpex VPS
Note: CryoFall server needs authenticated SteamCMD (non-anonymous);
run `just cryofall-stage` or `just wizard` to download game files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

Justfile

@@ -437,6 +437,48 @@ game-deploy GAME="" DRY="0":
     fi
     PROVISION_DRY_RUN="{{ DRY }}" bash scripts/provision-server.sh "${GAME}"
 
+# ─── Fire-and-forget wizard ───────────────────────────────────────────────────
+# Complete end-to-end server provisioning including Steam auth and game download.
+# Set environment variables before running:
+#   STEAM_USER, STEAM_PASS, GSA_STEAM_API_KEY (optional, for ID resolution)
+#   WIZARD_TARGET_HOST (optional, for remote Verpex deployment)
+
+# Interactive wizard — prompts for all values
+wizard GAME="cryofall":
+    bash scripts/wizard.sh --game {{ GAME }}
+
+# Unattended wizard — reads all values from environment
+wizard-auto GAME="cryofall":
+    WIZARD_GAME="{{ GAME }}" bash scripts/wizard.sh --game {{ GAME }} --unattended
+
+# Stage game files from Steam onto the deployment host
+# Requires: STEAM_USER, STEAM_PASS
+cryofall-stage:
+    bash scripts/steam-stage.sh \
+        --app-id 1200170 \
+        --target-volume cryofall-game-data
+
+# Stage game files to Verpex VPS (set WIZARD_TARGET_HOST or uses default)
+cryofall-stage-verpex:
+    bash scripts/steam-stage.sh \
+        --app-id 1200170 \
+        --target-volume cryofall-game-data \
+        --target-host root@209.42.26.106
+
+# Resolve a Steam vanity URL to a Steam64 ID
+# Usage: just steam-resolve VANITY=hyperpolymath API_KEY=<your-key>
+steam-resolve VANITY="" API_KEY="":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    VANITY="{{ VANITY }}"
+    KEY="{{ API_KEY }}"
+    [ -z "${KEY}" ] && KEY="${GSA_STEAM_API_KEY:-}"
+    if [ -z "${VANITY}" ]; then
+        echo "Usage: just steam-resolve VANITY=<username>"
+        exit 1
+    fi
+    GSA_STEAM_API_KEY="${KEY}" src/interface/ffi/zig-out/bin/gsa steam resolve "${VANITY}"
+
 # CryoFall shorthand — equivalent to: just game-deploy GAME=cryofall
 cryofall-deploy:
     just game-deploy GAME=cryofall
@@ -473,6 +515,39 @@ cryofall-status:
     echo "Systemd service:"
     systemctl --user status gsa-cryofall --no-pager 2>/dev/null | head -8 || echo "  Not installed"
 
+# Start self-healing watchdog in the foreground
+cryofall-watchdog:
+    bash scripts/self-heal.sh --container cryofall --port 6000
+
+# Install watchdog as a systemd user service (runs in background on Verpex)
+cryofall-watchdog-install:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    UNIT_FILE="${HOME}/.config/systemd/user/gsa-cryofall-watchdog.service"
+    mkdir -p "$(dirname "${UNIT_FILE}")"
+    REPO="$(pwd)"
+    cat > "${UNIT_FILE}" << UNIT
+    [Unit]
+    Description=GSA CryoFall self-heal watchdog
+    After=gsa-cryofall.service
+    Requires=gsa-cryofall.service
+
+    [Service]
+    Type=simple
+    ExecStart=/usr/bin/bash ${REPO}/scripts/self-heal.sh --container cryofall --port 6000
+    Restart=always
+    RestartSec=10s
+    StandardOutput=journal
+    StandardError=journal
+
+    [Install]
+    WantedBy=default.target
+    UNIT
+    systemctl --user daemon-reload
+    systemctl --user enable --now gsa-cryofall-watchdog
+    echo "Watchdog service installed and started."
+    systemctl --user status gsa-cryofall-watchdog --no-pager | head -6
+
 # Deploy to Verpex VPS via SSH (run this from local machine)
 # Requires SSH key access: root@209.42.26.106
 verpex-deploy GAME="cryofall":

container/cryofall/Containerfile

@@ -102,8 +102,14 @@ RUN groupadd -r -g 1500 cryofall && \
 # the linux32/ runtime directory it downloads on first run.
 
 COPY --from=steamcmd-installer /opt/steamcmd /opt/steamcmd
+# Create a wrapper script rather than a symlink.
+# steamcmd.sh uses dirname/$0 to locate linux32/steamcmd relative to itself,
+# so a bare symlink into /usr/local/bin/ breaks the relative path lookup.
+# The wrapper cd's into /opt/steamcmd first, keeping all relative paths intact.
 RUN chown -R cryofall:cryofall /opt/steamcmd && \
-    ln -sf /opt/steamcmd/steamcmd.sh /usr/local/bin/steamcmd
+    printf '#!/bin/sh\ncd /opt/steamcmd && exec ./steamcmd.sh "$@"\n' \
+        > /usr/local/bin/steamcmd && \
+    chmod +x /usr/local/bin/steamcmd
 
 # ── Application files ─────────────────────────────────────────────────────
 WORKDIR /app

container/cryofall/Settings.xml

@@ -96,10 +96,14 @@
     Find Steam IDs at: https://steamid.io/
   -->
   <!--
+    Joshua's Steam vanity URL "thekumonkid" did not resolve on Steam Community.
+    Check the correct vanity URL at: https://steamcommunity.com/id/thekumonkid
+    If that's wrong, find it at: steamcommunity.com → profile → Edit Profile → Custom URL
+    Replace JOSHUA_STEAM64_ID_HERE with the 17-digit number once confirmed.
+  -->
   <Operators>
-    <Operator steamId="JOSHUA_STEAM_ID_HERE"   name="Joshua Jewell" />
-    <Operator steamId="JONATHAN_STEAM_ID_HERE" name="Jonathan Jewell" />
+    <Operator steamId="JOSHUA_STEAM64_ID_HERE"  name="thekumonkid" />
+    <Operator steamId="76561198141836018"        name="hyperpolymath" />
   </Operators>
-  -->
 
 </server-settings>

container/cryofall/entrypoint.sh

@@ -56,13 +56,35 @@ trap cleanup TERM INT
 
 if [ ! -f "${SERVER_BINARY}" ]; then
     echo "[gsa-cryofall] CryoFall server not found at ${INSTALL_DIR}."
-    echo "[gsa-cryofall] Installing via SteamCMD (AppID ${APPID}) — this takes a few minutes (~3 GB)..."
-    "${STEAMCMD}" \
-        +force_install_dir "${INSTALL_DIR}" \
-        +login anonymous \
-        +app_update "${APPID}" validate \
-        +quit
-    echo "[gsa-cryofall] Game installation complete."
+
+    # CryoFall dedicated server (AppID 1200170) is a DLC of app 552990 and
+    # requires a Steam account that owns the game — anonymous login fails.
+    #
+    # Two routes to stage the server files:
+    #
+    # Route A — Steam credentials in environment (set STEAM_USER + STEAM_PASS):
+    if [ -n "${STEAM_USER:-}" ] && [ -n "${STEAM_PASS:-}" ]; then
+        echo "[gsa-cryofall] Installing via SteamCMD (authenticated as ${STEAM_USER})..."
+        "${STEAMCMD}" \
+            +force_install_dir "${INSTALL_DIR}" \
+            +login "${STEAM_USER}" "${STEAM_PASS}" \
+            +app_update "${APPID}" validate \
+            +quit
+        echo "[gsa-cryofall] Game installation complete."
+
+    # Route B — Files pre-staged into the volume by GSA provisioner:
+    # Run on the host (or locally) then rsync to the cryofall-game-data volume:
+    #   steamcmd +login <user> +force_install_dir ./cryofall-server \
+    #            +app_update 1200170 validate +quit
+    #   rsync -az ./cryofall-server/ root@209.42.26.106:/path/to/volume/
+    # Then restart this container — it will skip this block.
+    else
+        echo "[gsa-cryofall] ERROR: CryoFall server files not found and no Steam credentials set."
+        echo "[gsa-cryofall] Stage the server files first — see QUICKSTART-USER.adoc or:"
+        echo "[gsa-cryofall]   GSA GUI → CryoFall → Actions → 'Stage Server Files'"
+        echo "[gsa-cryofall]   Or set STEAM_USER + STEAM_PASS environment variables."
+        exit 1
+    fi
 fi
 
 # ---------------------------------------------------------------------------