refactor: item 29 cleanup

C14 C16 C17 C18 C20 A11 A15 X10 X12 X15: dead Steam count code, GameNames, steamIdText, one query per game for the finished estimate, no API versioning config, open-in-view off, CORS from APP_FRONTEND_URL, non-root image, prune only up to the highest known id.

readme.md

@@ -76,9 +76,9 @@ To Be Played is split into three repositories:
 ## Authentication
 
 Core never issues tokens. It verifies Auth's EdDSA (Ed25519) JWTs with public keys only. It loads them from Auth's
-JWKS by the token's `kid` and loads again when a new `kid` shows up (at most every 10 seconds). Loaded keys stay
-until Core restarts. `JWT_PUBLIC_KEY` is used only until the first JWKS load works. The token comes from Auth's
-`tbp_access` cookie or a `Bearer` header, whichever verifies first. Every token names its kind in `aud`
+JWKS by the token's `kid` and loads again when a new `kid` shows up (at most every 10 seconds). Each load replaces
+the key set: a key that left the JWKS stops working. `JWT_PUBLIC_KEY` is used only until the first JWKS load works.
+The token comes from Auth's `tbp_access` cookie or a `Bearer` header, whichever verifies first. Every token names its kind in `aud`
 (`tbp-login`, `tbp-public-profile`, `tbp-internal`, with `iss=tbp-auth`); a login's `sub` is the user id. Core reads
 `steamId` and the active `role` (missing or unknown = USER) from the claims and grants that role and every lower one
 (`USER < AUDITOR < PLATFORM_ADMIN`). A token without `aud` comes from an Auth from before item 26 (kind in `typ`,
@@ -98,11 +98,19 @@ only guard.
 Every service method a controller calls carries one role marker, on the method or on its class (the method wins):
 `@RequiresRole(Role.X)`, `@Public` (no login, e.g. landing stats; the public profile checks its ticket) or
 `@Internal` (only Auth's service token). A Spring Security method interceptor checks it while a request is served;
-scheduled jobs and background work run without a user and are not checked. A denied call answers `401` without a
+scheduled jobs and background work run without a user and are not checked. That stays on purpose: the sync
+worker calls `SteamApiService` and the import worker `ManualGameService`, both `@RequiresRole(USER)`, without a
+request. Auth denies instead, because it has no such caller. A denied call answers `401` without a
 login, else `403`. The URL rules in `SecurityConfig` stay as the outer guard. ArchUnit fails the build for an
 unmarked method, two markers, a controller calling an `@Async` method (the check would never run), and a service
 method calling another service's method that needs more.
 
+**Mirrored in Auth.** These files exist in both services with small differences; a change in one needs the same
+change in the other: `ClientHeaderFilter`, `RoleAuthorizationManager`, `MethodSecurityConfig`, `Role`, `RequiresRole`,
+`Public` (only Core has `Internal`), `UserPrincipal`, the login token check in `JwtService.parseLoginToken`, the
+ArchUnit role rules (`RoleAnnotationRules`) and `src/test/resources/contract/auth-core-contract.json`
+(`ToBePlayed-Deployment/scripts/check-contract.sh` compares the two).
+
 ## API
 
 | Method | Path | Auth |