feat: implement and deploy blind_chess MVP

- pnpm workspace: shared/server/client packages
- Server: Fastify+ws, chess.js, FSM (touch-move + hierarchy),
  per-player view filter, zod validation, rate limiting, grace-window
  disconnect handling
- Client: Svelte 5 + Vite, click-to-move board, moderator panel,
  promotion/draw dialogs
- Shared: protocol types, ModeratorText enum, geometricMoves helper
  (provably zero opponent-info leak)
- 43 tests pass (21 shared, 22 server incl. 4 real-WS integration)
- Deploy: CT 690 on node-241 (192.168.0.245), systemd-managed,
  Caddy block for chess.sethpc.xyz
- Live at https://chess.sethpc.xyz

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/server/src/validation.ts

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+
+const colorSchema = z.union([z.literal('w'), z.literal('b')]);
+const squareSchema = z.string().regex(/^[a-h][1-8]$/);
+const promotionSchema = z.union([z.literal('q'), z.literal('r'), z.literal('b'), z.literal('n')]);
+const gameIdSchema = z.string().regex(/^[a-z0-9]{8}$/);
+const tokenSchema = z.string().regex(/^[a-z0-9]{24}$/);
+
+export const helloSchema = z.object({
+  type: z.literal('hello'),
+  gameId: gameIdSchema,
+  token: tokenSchema.optional(),
+  joinAs: z.union([colorSchema, z.literal('auto')]).optional(),
+});
+
+export const commitSchema = z.object({
+  type: z.literal('commit'),
+  from: squareSchema,
+  to: squareSchema.optional(),
+  promotion: promotionSchema.optional(),
+});
+
+export const resignSchema = z.object({ type: z.literal('resign') });
+export const offerDrawSchema = z.object({ type: z.literal('offer-draw') });
+export const respondDrawSchema = z.object({
+  type: z.literal('respond-draw'),
+  accept: z.boolean(),
+});
+export const pongSchema = z.object({ type: z.literal('pong') });
+
+export const clientMessageSchema = z.discriminatedUnion('type', [
+  helloSchema,
+  commitSchema,
+  resignSchema,
+  offerDrawSchema,
+  respondDrawSchema,
+  pongSchema,
+]);
+
+export const createGameSchema = z.object({
+  mode: z.union([z.literal('blind'), z.literal('vanilla')]),
+  side: z.union([colorSchema, z.literal('random')]),
+  highlightingEnabled: z.boolean(),
+});