fix: auto-provision Creator on login, enforce the_creator archetype everywhere

Login auto-creates a human fighter for the Creator pubkey if no DB entry
exists. register-human now applies the_creator archetype for the Creator.
Update endpoint can no longer override the Creator's archetype.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/auth.ts

@@ -55,6 +55,45 @@ authRouter.post('/login', async (c) => {
   }).from(schema.bots).where(eq(schema.bots.publicKey, pubkey)).limit(1)
 
   if (rows.length === 0) {
+    // Auto-create human fighter for the Creator if not registered
+    if (pubkey === CREATOR_PUBKEY) {
+      const id = nanoid(12)
+      const secret = randomBytes(32).toString('hex')
+      await db.insert(schema.bots).values({
+        id,
+        name: 'the_creator',
+        webhookUrl: 'http://human.local/',
+        avatarSeed: 'the_creator',
+        archetype: 'the_creator',
+        secretHash: createHash('sha256').update(secret).digest('hex'),
+        publicKey: pubkey,
+        profilePicUrl: null,
+        customization: null,
+        createdAt: new Date().toISOString(),
+      })
+      return c.json({
+        exists: true,
+        bot: {
+          id,
+          name: 'the_creator',
+          avatarSeed: 'the_creator',
+          archetype: 'the_creator',
+          profilePicUrl: null,
+          eloRating: 1200,
+          wins: 0,
+          losses: 0,
+          winStreak: 0,
+          bestStreak: 0,
+          tier: 0,
+          isActive: true,
+          isHuman: true,
+          customization: null,
+          satsWon: 0,
+          satsWagered: 0,
+          hasWallet: false,
+        },
+      })
+    }
     return c.json({ exists: false, pubkey })
   }
 
@@ -231,12 +270,14 @@ authRouter.post('/register-human', rateLimit(3600_000, 15), async (c) => {
   const id = nanoid(12)
   const secret = randomBytes(32).toString('hex')
 
+  const humanArchetype = pubkey === CREATOR_PUBKEY ? 'the_creator' : 'human'
+
   await db.insert(schema.bots).values({
     id,
     name: normalizedName,
     webhookUrl: 'http://human.local/',
     avatarSeed: avatarSeed || normalizedName,
-    archetype: 'human',
+    archetype: humanArchetype,
     secretHash: createHash('sha256').update(secret).digest('hex'),
     publicKey: pubkey,
     profilePicUrl: profilePicUrl || null,
@@ -247,7 +288,7 @@ authRouter.post('/register-human', rateLimit(3600_000, 15), async (c) => {
   return c.json({
     id,
     name: normalizedName,
-    archetype: 'human',
+    archetype: humanArchetype,
     isHuman: true,
     message: 'Human fighter registered.',
   }, 201)
@@ -308,8 +349,8 @@ authRouter.post('/update', async (c) => {
     const existing = rows[0].customization ? JSON.parse(rows[0].customization) : {}
     const merged = { ...existing, ...custResult.data }
     updates.customization = JSON.stringify(merged)
-    // Update archetype if set in customization
+    // Update archetype if set in customization (but never override the_creator)
-    if (custResult.data.archetype) {
+    if (custResult.data.archetype && pubkey !== CREATOR_PUBKEY) {
       updates.archetype = custResult.data.archetype
     }
   }