feat: v4 — TUI fight loop, rate limiting, webhook tooling, expanded choreographies

- Fight loop CLI with TUI renderer (ink-style terminal UI)
- Rate limiting middleware for API routes
- Queue cooldowns wired into orchestrator after fights
- Webhook test utility for bot debugging
- API docs route
- Expanded FightScene choreographies and weapon props
- Fix Drizzle transaction execution in orchestrator
- Schema additions, scoring/challenge/mock expansions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/auth.ts

@@ -2,11 +2,14 @@ import { Hono } from 'hono'
 import { nanoid } from 'nanoid'
 import { createHash, randomBytes } from 'crypto'
 import { db, schema } from '../db/index.js'
-import { eq } from 'drizzle-orm'
+import { eq, sql } from 'drizzle-orm'
+import { isAllowedWebhookUrl } from '../engine/orchestrator.js'
+import { testWebhook } from '../engine/webhook-test.js'
+import { rateLimit } from '../middleware/rate-limit.js'
 
 export const authRouter = new Hono()
 
-// Login with Nostr pubkey — returns bot if one exists
+// Login with Nostr pubkey
 authRouter.post('/login', async (c) => {
   const body = await c.req.json()
   const { pubkey } = body
@@ -27,6 +30,7 @@ authRouter.post('/login', async (c) => {
     winStreak: schema.bots.winStreak,
     bestStreak: schema.bots.bestStreak,
     tier: schema.bots.tier,
+    isActive: schema.bots.isActive,
   }).from(schema.bots).where(eq(schema.bots.publicKey, pubkey)).limit(1)
 
   if (rows.length === 0) {
@@ -37,7 +41,7 @@ authRouter.post('/login', async (c) => {
 })
 
 // Register a new bot with Nostr pubkey
-authRouter.post('/register', async (c) => {
+authRouter.post('/register', rateLimit(3600_000, 5), async (c) => {
   const body = await c.req.json()
   const { pubkey, name, webhookUrl, archetype, profilePicUrl } = body
 
@@ -53,6 +57,8 @@ authRouter.post('/register', async (c) => {
     return c.json({ error: 'Name must be alphanumeric, hyphens, or underscores.' }, 400)
   }
 
+  const normalizedName = name.toLowerCase()
+
   if (!webhookUrl || typeof webhookUrl !== 'string') {
     return c.json({ error: 'webhookUrl is required.' }, 400)
   }
@@ -63,6 +69,10 @@ authRouter.post('/register', async (c) => {
     return c.json({ error: 'webhookUrl must be a valid URL.' }, 400)
   }
 
+  if (!isAllowedWebhookUrl(webhookUrl)) {
+    return c.json({ error: 'webhookUrl must not point to private/internal addresses.' }, 400)
+  }
+
   // Check pubkey not already used
   const existingPk = await db.select({ id: schema.bots.id })
     .from(schema.bots)
@@ -73,24 +83,34 @@ authRouter.post('/register', async (c) => {
     return c.json({ error: 'This Nostr key already has a bot.' }, 409)
   }
 
-  // Check name not taken
+  // Check name not taken (case-insensitive)
   const existingName = await db.select({ id: schema.bots.id })
     .from(schema.bots)
-    .where(eq(schema.bots.name, name))
+    .where(eq(sql`LOWER(${schema.bots.name})`, normalizedName))
     .limit(1)
 
   if (existingName.length > 0) {
     return c.json({ error: 'A bot with that name already exists.' }, 409)
   }
 
+  // Test the webhook
+  const testResult = await testWebhook(webhookUrl)
+  if (!testResult.reachable || !testResult.validResponse) {
+    return c.json({
+      error: 'Webhook verification failed.',
+      details: testResult.error || 'Webhook must return {"answer": "..."} as JSON.',
+      latencyMs: testResult.latencyMs,
+    }, 422)
+  }
+
   const id = nanoid(12)
   const secret = randomBytes(32).toString('hex')
 
   await db.insert(schema.bots).values({
     id,
-    name,
-    webhookUrl: webhookUrl,
-    avatarSeed: name,
+    name: normalizedName,
+    webhookUrl,
+    avatarSeed: normalizedName,
     archetype: archetype || 'standard',
     secretHash: createHash('sha256').update(secret).digest('hex'),
     publicKey: pubkey,
@@ -100,9 +120,10 @@ authRouter.post('/register', async (c) => {
 
   return c.json({
     id,
-    name,
+    name: normalizedName,
     archetype: archetype || 'standard',
-    message: 'Bot registered.',
+    webhookLatencyMs: testResult.latencyMs,
+    message: 'Bot registered. Webhook verified.',
   }, 201)
 })
 
@@ -124,8 +145,25 @@ authRouter.post('/update', async (c) => {
     return c.json({ error: 'No bot found for this key.' }, 404)
   }
 
-  const updates: Record<string, string> = {}
-  if (webhookUrl) updates.webhookUrl = webhookUrl
+  const updates: Record<string, unknown> = {}
+
+  if (webhookUrl) {
+    if (!isAllowedWebhookUrl(webhookUrl)) {
+      return c.json({ error: 'webhookUrl must not point to private/internal addresses.' }, 400)
+    }
+    // Test new webhook before accepting
+    const testResult = await testWebhook(webhookUrl)
+    if (!testResult.reachable || !testResult.validResponse) {
+      return c.json({
+        error: 'Webhook verification failed.',
+        details: testResult.error,
+      }, 422)
+    }
+    updates.webhookUrl = webhookUrl
+    updates.consecutiveErrors = 0
+    updates.isActive = true
+  }
+
   if (profilePicUrl) updates.profilePicUrl = profilePicUrl
 
   if (Object.keys(updates).length > 0) {