feat: add authenticated realtime presence

CONTRACT.md

@@ -193,6 +193,11 @@ Three backends were designed for one box — three ports, three frameworks, thre
   public box.
 - `Cache-Control` is fail-closed: a global hook stamps `private, no-store`, and
   a route opts in to public caching explicitly.
+- Authenticated realtime is a route module in this same process, not another
+  daemon. Its state is bounded and memory-only. Event credentials travel in a
+  POST body, never a URL; the server owns interest filtering, motion validation,
+  token rotation and revocation. The auth subject is not a peer-visible entity
+  id, and no media is carried on the game-state stream.
 
 ### 5.1 Zero-config boot must actually boot