KullGames V2 Architecture

    Player                         Automation Script
      |                                  |
      |  HTTPS                           |  HTTPS + Bearer
      v                                  v
  ====================================================================
  |         WINDOWS SERVER  (IIS Reverse Proxy)                      |
  |                                                                  |
  |   /  --> :5000       /auth --> :5001       /api --> :5002         |
  |     |                   |                    |                   |
  |     v                   v                    v                   |
  |  [+-----------+]    +-----------+     +-----------+            |
  |  [|    WEB    |]    |   AUTH    |     |    API    |            |
  |  [| Bootstrap |]    | Cookies   |     | Protected |            |
  |  [| HTML / JS |]    | OTUT Gen  |     | Resources |            |
  |  [| No Razor  |]    | Fingerprnt|     | Game Data |            |
  |  [+-----------+]    +-----+-----+     +-----------+            |
  |                          |                                      |
  |                     +----+----+                                  |
  |                     | SQLite  |                                  |
  |                     +---------+                                  |
  ====================================================================

  [KullGames.Web] — The Frontend
  ==================================

  What it does:
  +---------------------------------------------------+
  |  Serves a SINGLE inline HTML page from Program.cs  |
  |  No Razor. No Blazor. No .cshtml. No .html files.  |
  |  Just a C# string returned via app.MapGet("/")     |
  +---------------------------------------------------+

  How it talks to other services:

  Browser -----> [/]                 This service (HTML + JS)
  Browser -----> /auth/api/Login     Proxied to Auth by IIS
  Browser -----> /auth/api/WhoAmI    Proxied to Auth by IIS
  Browser -----> /api/data           Proxied to Api by IIS

  Key files:
  +-- Program.cs ............ ~409 lines, THE file
  +-- wwwroot/ .............. logos, images
  +-- (that's it)

  Tech stack:
  * Bootstrap 5.3 (CDN)     * FontAwesome 6 (CDN)
  * Fredoka + Open Sans     * Vanilla JS (no frameworks)
  * .NET Minimal API        * No custom CSS files

  Step 1: LOGIN
  Browser --POST /auth/api/Login--> Auth
  Auth --.KullGames.Auth cookie---> Browser    (30-day, HttpOnly)

  Step 2: [GET A TOKEN]
  Browser --POST /auth/api/GenerateWebToken--> Auth
           {endpoint: "/api/data", method: "GET"}
  Auth --{token: "abc123"}--> Browser          (60s, one-time-use)

  Step 3: USE THE TOKEN
  Browser --GET /api/data, X-Api-Token: abc123--> Api
  Api --validate token--> Auth
  Auth --valid + claims--> Api
  Api --{servers: [...]}--> Browser
  Auth: BURN token (can never be reused)