[Okazakee]

Summary

• Adds a stable API error contract with request IDs and correlated logs.
• Resolves D-9 with an explicit bcrypt 72 UTF-8-byte password policy.
• Adds progressive account/source login-abuse protection and removes dead throttle configuration.
• Adds Minecraft CPU/PID isolation and a reproducible pinned Minecraft image.
• Adds trusted real-Docker lifecycle CI coverage.
• Reconciles SPEC, README, deployment docs, and roadmap state.

PKCE remains explicitly deferred and is not part of this change.