Prepare game updates and single-process PM2 deployment

tests/server.test.ts

@@ -16,6 +16,7 @@ test('HTTP game registration survives server restart without game timers and old
   try {
     const url = await app.listen({ host: '127.0.0.1', port: 0 });
     assert.equal((await app.inject('/health')).statusCode, 200);
+    assert.equal((await app.inject('/ready')).statusCode, 200);
     const session = (await app.inject({ method: 'POST', url: '/api/game-sessions', payload: { createRequestId: randomBytes(32).toString('base64url') } })).json().data;
     const headers = { authorization: 'Bearer ' + session.token, 'x-game-session': session.gameSessionId };
     const input = { requestId: 'register', matchId: 'bot-match', mode: 'bot', expectedPreviousSeq: 0 };
@@ -37,3 +38,20 @@ test('HTTP game registration survives server restart without game timers and old
     assert.equal(state.activeMatch, undefined); assert.equal(state.stats.bot.losses, 1);
   } finally { socket?.disconnect(); await app.close(); try { await client.db(databaseName).dropDatabase(); } finally { await client.close(); } }
 });
+
+test('production server enforces session limits before database creation', { skip: !uri }, async () => {
+  const databaseName = 'dragon_ball_test_limits_' + randomUUID().replaceAll('-', '');
+  const app = await createGameServer({ mongoUri: uri!, databaseName, clientDirectory: 'dist/client', environment: 'test' });
+  const client = await new MongoClient(uri!).connect();
+  try {
+    for (let i = 0; i < 30; i++) {
+      assert.equal((await app.inject({ method: 'POST', url: '/api/game-sessions', payload: {} })).statusCode, 400);
+    }
+    const response = await app.inject({ method: 'POST', url: '/api/game-sessions',
+      payload: { createRequestId: randomBytes(32).toString('base64url') } });
+    assert.equal(response.statusCode, 429);
+    assert.ok(Number(response.headers['retry-after']) > 0);
+    assert.equal(await client.db(databaseName).collection('players').countDocuments(), 0);
+    assert.equal(await client.db(databaseName).collection('game_sessions').countDocuments(), 0);
+  } finally { await app.close(); try { await client.db(databaseName).dropDatabase(); } finally { await client.close(); } }
+});