Add neutral administrator lobby configuration

Configure supported rules/modules and AI seats or assign an existing human as host without granting private-seat access. Use genuine unused-lobby checks, existing engine actions, live authorization/version/pause/seat fences and atomic audit receipts. Preserve exact account-bound retries across refresh and confirm completed operations after game start without resetting play.

Verified types, lint, 5260 offline tests, 52 HTTP tests and build. Eleven authenticated HTTP groups and independent privacy/persistence review passed. Browser QA confirmed one AI and audit after a lost response and refresh/retry, persisted rules and AI configuration, and readable 1280/390px layouts. All existing rooms and seats preserved. Actual authenticated production administrator acceptance remains pending authorized QA operator access.

tools/verify-admin.mjs

@@ -7,6 +7,7 @@ import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { verifyRoomLifecycle } from './admin-lifecycle-verification.mjs';
 import { verifyRoomCreation } from './admin-creation-verification.mjs';
+import { verifyLobbyConfiguration } from './admin-lobby-verification.mjs';
 
 const options = {};
 for (let n = 2; n < process.argv.length; n += 2) {
@@ -31,7 +32,7 @@ async function request(path, body, cookie, origin = base, expectedAdminId = admi
   const response = await fetch(base + path, {
     method: body === undefined ? 'GET' : 'POST',
     headers: { ...(body === undefined ? {} : { 'content-type': 'application/json', origin }), ...(cookie ? { cookie } : {}),
-      ...(expectedAdminId && (path === '/api/admin/rooms' && body !== undefined || /^\/api\/admin\/rooms\/[^/]+\/control$/.test(path)) ? { 'X-Dune-Admin-Id': expectedAdminId } : {}) },
+      ...(expectedAdminId && (path === '/api/admin/rooms' && body !== undefined || /^\/api\/admin\/rooms\/[^/]+\/(control|lobby)$/.test(path)) ? { 'X-Dune-Admin-Id': expectedAdminId } : {}) },
     ...(body === undefined ? {} : { body: JSON.stringify(body) }), signal: AbortSignal.timeout(15000),
   });
   report.lastRequest = { path, status: response.status };
@@ -85,6 +86,7 @@ try {
     session1 = lifecycleSession.cookie;
     await verifyRoomLifecycle(request, session1, report);
     await verifyRoomCreation(request, session1, report);
+    await verifyLobbyConfiguration(request, session1, report);
   }
   report.passed = true;
 } catch (error) {