Add Brogue CE as a new door game

[mpiorowski]

Summary

• Adds Brogue Community Edition (the real upstream curses roguelike) as a new door game on the Games hub, following the DCSS door's proven network-host pattern: a dedicated SSH host crate (late-brogue) runs the real brogue binary over a PTY, and late-ssh connects to it as an SSH client, streaming the remote terminal through vt100 into the existing ratatui door chrome.
• Unlike DCSS/NetHack, Brogue has no -name flag, so player identity is a per-player working directory (LATE_BROGUE_DATA_DIR/players/<playname>) keyed by the same claim-once arcade handle used by the other doors; saves and high scores are per-player, with no shared scoreboard in v1.
• Ships with one upstream source patch (scripts/brogue_hangup_save.patch) that adds a SIGHUP/SIGTERM save-on-disconnect handler the stock curses build lacks, so a dropped SSH connection or a host redeploy doesn't lose an in-progress run.

Changes

• New late-brogue workspace crate: russh server (server.rs), per-session PTY bridge with SIGHUP-save teardown (host.rs), config (config.rs), shared-secret Ed25519 key derivation (identity.rs), and playname sanitization used as the save-directory path-traversal boundary (playname.rs).
• New late-ssh/src/app/door/brogue client module (proxy/identity/state/render), wired into the Games hub as an 8th card (HubGame::Brogue, after DCSS), the top-level app state/input/render/tick lifecycle, and SessionConfig/config.rs/ssh.rs/session_bootstrap.rs/test helpers.
• Dockerfile: new brogue-build stage compiling Brogue CE 1.15.1 from a SHA-256-verified upstream tarball (curses-only, TERMINAL=YES GRAPHICS=NO) with the hangup-save patch applied, plus a runtime-brogue image stage.
• Infra: infra/brogue.tf (RWO save PVC), infra/service-brogue.tf (Deployment + ClusterIP service), infra/secrets.tf (shared identity secret), new CI workflows .github/workflows/brogue.yml (build validation) and deploy_brogue.yml (image build/push); other deploy/terraform workflows updated to pass through the late-brogue image tag.
• NOTICE updated with Brogue CE's AGPL-3.0 attribution and network-clause (section 13) compliance notes, since we ship a patched build.
• CONTEXT.md, late-ssh/src/app/door/brogue/CONTEXT.md (new), DOOR.md, and help_modal/data.rs (bot/bartender app context) updated to document and route to the new door.

Behavior notes

• Gated behind LATE_BROGUE_ENABLED (default false); when disabled the launcher shows "Currently unavailable" and connect is a no-op, but the host pod deploys unconditionally.
• No CLI args are ever passed to the child (argv stays empty) so wizard/seed flags stay unreachable to players; TERM and per-session HOME are the only allowlisted env vars, and LINES/COLUMNS are intentionally not exported since ncurses freezes at spawn-time geometry (the PTY winsize is the only size source).
• No awards/chips/milestones in v1 (like dopewars/DCSS at launch); Brogue writes a machine-readable per-player run history file that a future award pipe can read host-side.
• Because the host crate must ship before the client can reach it, first rollout after merge must run deploy_brogue.yml before any other deploy workflow, or the image lookup will fail.

Feature flags

• LATE_BROGUE_ENABLED (client, default false) gates the door in the Games hub.
• LATE_BROGUE_HOST / LATE_BROGUE_PORT / LATE_BROGUE_SECRET (client) must match the host's LATE_BROGUE_SECRET / listen config.

Screenshots / Video

Not included in this draft; attach before review (a live terminal screenshot of the Brogue landing/running screens would be the most reviewer-useful asset here, per DOOR.md's "best screenshots a terminal can produce" goal for this door).

Testing

• Automated: new inline _test.rs coverage for client+host identity (derivation determinism/distinctness, cross-crate known-answer fingerprint), client state (disabled connect no-op, input forwarding/stripping, F1 remap, exit grace, claim-prompt handling), host playname (sanitize incl. path traversal), host server (effective_term fallback), host host (player_dir distinctness), and hub state/primitives updates for the new card. Run via make test-llm ARGS="-E 'package(late-brogue) or (package(late-ssh) and test(brogue))'".
• Manual: the PTY bridge and russh loops are process/network-bound and not unit-tested; the hangup-save patch was verified by hand (start a game on a PTY, SIGHUP it, confirm the save file is written). Full launch/save/quit flow should be re-verified manually against a real service-brogue host before/after the prod rollout.