Fow web UI

[niugnip]

Adds Fog of War support to the backend payload that feeds the new web UI, so FoW games can be viewed in it at all. Until now the new UI was hard-blocked for FoW games and players were sent to the old image-based view.

Pairs with AsyncTI4/ti4_web_new#138— this needs to merge first, or the frontend reads fields that don't exist yet.

What it does

/web-data-fow serves a per-viewer filtered payload:

• Tiles outside current vision are replaced with the viewer's remembered "ghost" snapshot, flagged with the same "last seen" label the Discord PNG already draws.
• Unit and control-token faction identity is obscured behind a fow:<color> sentinel — the real color still renders (matching DrawingUtil#drawControlToken, which draws the colored token but skips the faction seal), but the faction behind it doesn't.
• Player stats, score breakdowns, objective progress, elected laws and expedition completers are redacted for players the viewer can't identify.
• Hidden players' identity never reaches the client at all: objective scorers they can't be tied to are collapsed into a bare unidentifiedScorerCount, their score breakdowns are omitted entirely (score-track totals travel as faction-less hiddenPlayerVps), strategy-card picks are cleared unless the viewer can see that player's stats (with trade goods blanked so unpicked cards can't be identified by elimination), and stat-tile positions are dropped for them.
• Per-planet exhausted is now populated for on-tile planets. The web UI previously derived this from each player's exhaustedPlanets list, which isn't available for unidentified players, so exhausted planets in visible systems rendered as ready.

The GM/owner gets the unfiltered payload, and can preview any player's fogged view via ?asPlayer= for debugging. X-Viewer-Is-Gm distinguishes "GM previewing a player" from "that player's own view", which are otherwise identical in shape.

FoW games stream only a "refresh" signal over the websocket rather than a patch — the payload differs per viewer, so clients refetch and the fog is re-applied server-side.

Commits

Reviewable in order; each builds standalone.

1. Send the hyperlane connection matrix in the web tile payload — unrelated to FoW; the web map couldn't draw custom hyperlane tiles without it.
2. Add Fog of War support for the new web UI — the bulk of the change.
3. Let the GM see the event log in FoW games
4. Stop treating the neutral player as a hidden FoW opponent — the neutral (Dicecord) player isn't a "real player" per FoWHelper#canSeeStatsOfPlayer, so it was failing every identity check as though it were a hidden opponent. Also counts neutral production, which affects non-FoW games too, where it simply wasn't counted before.
5. Add niugnip's server roles — unrelated to the rest; separated so it can be judged on its own.
6. Restrict the FoW web UI to FoW server staff in production — temporary rollout gate, see below.
7. Withhold hidden players' identity from the FoW payload — the earlier redaction still sent every scorer's real faction and left the client to render the unidentifiable ones anonymously; the answer was sitting in the JSON. This moves all of that server-side (see the fourth bullet above).
8. Fail closed on unresolvable factions in the FoW redaction — review follow-up: a faction string that can't be resolved to a player is now redacted rather than passed through, matching the rollout gate's fail-closed policy.

The rollout gate

The gate commit limits the FoW web-data and event endpoints to holders of one of the FoW server's staff roles (server, Game Supervisor, and the Chapter 2 bothelper/supervisor equivalents), in production only (JdaService#isProduction()), so dev bots are unaffected. GMs are not exempt — most hold one of these already, and exempting them would leave nearly every FoW game reachable.

Deliberately scoped to that server's own roles rather than reusing bothelperRoles, which spans every Async and community server plus all admins and developers — far wider than this gate is meant to be.

It fails closed: unresolvable roles are skipped and access is denied rather than treating "couldn't check" as a pass. Revert that single commit to lift the restriction — nothing else depends on it.

This also adds JdaService#hasAnyRole(userId, roleIds...), since the existing role checks need an interaction event and the web API only has a Discord user ID. It reads JDA's member cache, which is populated eagerly (MemberCachePolicy.ALL / ChunkingFilter.ALL), so it stays a synchronous lookup rather than a REST call on the request thread.

It also relabels role 1063464689218105354 from "FoW Server Game Admin" to "FoW Server Game Supervisor", matching what that role is actually called now.

Testing

Full mvn install clean: 327 tests, 0 failures, 0 errors, SpotBugs and Spotless clean. Exercised manually against a local FoW save as GM, as a participant, and via GM preview-as-player. The identity withholding was additionally verified against a running bot with a player forced unidentifiable: their faction no longer appears anywhere in the fogged payload.

The gate itself was exercised against a running bot by temporarily forcing it on and substituting a role this test bot can see: a user holding the role got the payload, while a user without it — including an actual participant in the game — got a 403. That confirms the lookup resolves a role from a non-primary guild, hits the member cache synchronously rather than making a REST call, and sits above the participant check rather than only the GM branch.

Not verified: that the four production role IDs themselves resolve, since this bot isn't in the FoW server. The mechanism is proven; only those specific IDs aren't. Worth a look at the first deploy, given it fails closed.