feat: dedicated server security hardening

Comprehensive security system to protect against packet-sniffing attacks,
XUID harvesting, privilege escalation, bot flooding, and XUID impersonation.

- Stream cipher: per-session XOR cipher with 4-message handshake via
  CustomPayloadPacket (MC|CKey, MC|CAck, MC|COn). Negotiated per-connection,
  backwards compatible (old clients/servers fall back to plaintext).
- Security gate: buffers all game data until cipher handshake completes,
  preventing unsecured clients from receiving any XUIDs or game state.
- Cipher handshake enforcer: kicks clients that don't complete the handshake
  within 5 seconds (configurable via require-secure-client).
- Identity tokens: persistent per-XUID tokens in identity-tokens.json,
  issued over the encrypted channel, verified on reconnect. Prevents XUID
  replay attacks. Client stores server-specific tokens.
- PROXY protocol v1: parses real client IPs from playit.gg tunnel headers
  so rate limiting, IP bans, and XUID spoof detection work per-player.
- Rate limiting: per-IP sliding window (default 5 connections/30s) with
  pending connection cap (default 10).
- Privilege hardening: OP requires ops.json, live checks on every command
  and privilege packet. Host-only server settings changes.
- XUID stripping: PreLoginPacket response sends INVALID_XUID placeholders.
- Packet validation: readUtf global string cap, reduced max packet size,
  stream desync protection on oversized strings.
- OpManager: persistent ops.json with XUID-based OP list.
- Whitelist improvements: whitelist add accepts player names with ambiguity
  detection, XUID cache from login attempts.
- revoketoken command: revoke identity tokens for players who lost theirs.
- server.log: persistent log file written alongside console output with
  flush-per-write to survive crashes.
- CLI security logging: consolidated per-join security summary with cipher
  status, token status, XUID, and real IP. Security warnings for kicks,
  spoofing, and unauthorized commands.

Minecraft.Server/Security/IdentityTokenManager.h

@@ -0,0 +1,63 @@
+#pragma once
+
+#include <string>
+#include <unordered_map>
+#include <vector>
+#include <cstdint>
+
+#ifdef _WINDOWS64
+#include <Windows.h>
+#endif
+
+typedef unsigned __int64 PlayerUID;
+
+namespace ServerRuntime
+{
+	namespace Security
+	{
+		/**
+		 * Persistent XUID-to-token binding for identity verification.
+		 *
+		 * On first login, the server issues a random 32-byte token to the client
+		 * over the encrypted cipher channel. The client stores it locally.
+		 * On subsequent logins, the server challenges the client to present
+		 * its stored token. Mismatch = kicked.
+		 *
+		 * This prevents XUID replay attacks: an attacker who steals a XUID
+		 * still needs the token, which was only sent over the encrypted channel.
+		 *
+		 * Tokens are stored in `identity-tokens.json` and persist across restarts.
+		 */
+		class IdentityTokenManager
+		{
+		public:
+			static const int TOKEN_SIZE = 32;
+
+			IdentityTokenManager();
+			~IdentityTokenManager();
+
+			IdentityTokenManager(const IdentityTokenManager &) = delete;
+			IdentityTokenManager &operator=(const IdentityTokenManager &) = delete;
+
+			bool Initialize(const std::string &filePath);
+			void Shutdown();
+
+			bool HasToken(PlayerUID xuid) const;
+			bool GetToken(PlayerUID xuid, uint8_t outToken[TOKEN_SIZE]) const;
+			bool IssueToken(PlayerUID xuid, uint8_t outToken[TOKEN_SIZE]);
+			bool VerifyToken(PlayerUID xuid, const uint8_t token[TOKEN_SIZE]) const;
+			bool RevokeToken(PlayerUID xuid);
+
+		private:
+			bool Load();
+			bool Save() const;
+
+			std::string m_filePath;
+			std::unordered_map<PlayerUID, std::vector<uint8_t>> m_tokens;
+			mutable CRITICAL_SECTION m_lock;
+			bool m_initialized;
+		};
+
+		IdentityTokenManager &GetIdentityTokenManager();
+	}
+}