feat: Go backend production cutover — website layer, ingest forwarding, alerts, live fixes

Completes the Go backend so it can fully replace Python in production:

tracker-go website layer (serves the unchanged frontend):
- static file serving + SPA fallback + /icons (website.go)
- login/logout with itsdangerous cookie ISSUING (bcrypt, Python-interop) and the
  /me handler (auth.go issueSessionCookie + website.go)
- admin user CRUD (website_admin.go) and the issue-board write side (website_issues.go)
- request-scoped user context + requireAdmin (auth.go)

cutover ingest (gated off during the parallel run, required for a clean cutover):
- inventory forwarding: full_inventory -> /process-inventory, inventory_delta ->
  item POST/DELETE, per-character serialized, fire-and-forget (inventory_forward.go)
- death/idle Discord alerts via DISCORD_ACLOG_WEBHOOK (aclog.go)
- SKIP_SCHEMA_INIT so write mode against the prod DBs runs no DDL (tracker-go + inventory-go)

two bugs found live and fixed:
- coerceNum: the plugin sends kills_per_hour/deaths/total_deaths/prismatic_taper_count
  as STRINGS; pydantic coerced them, Go's number helpers wrote null/0 (reads.go/ingest.go)
- telemetry is broadcast TYPELESS so the browser ignores it and uses the /live poll;
  broadcasting it typed flapped the per-player counters 0<->value (ingest.go stripType)

docker-compose.cutover.yml: reversible override flipping the Go services to write
mode against the production DBs and repointing the Discord bot at the Go /ws/live.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

go-services/docker-compose.cutover.yml

@@ -0,0 +1,32 @@
+# Cutover override — flips the Go services from read-only parallel mode to
+# PRODUCTION write mode, reusing the existing production databases (no data
+# migration). Apply ON TOP of the base + go overrides:
+#
+#   docker compose -f docker-compose.yml -f go-services/docker-compose.go.yml \
+#       -f go-services/docker-compose.cutover.yml up -d --no-deps \
+#       dereth-tracker-go inventory-go discord-rare-monitor
+#
+# Reversible: re-up WITHOUT this file to return the Go services to read-only
+# parallel mode (and start the Python services back up for rollback).
+#
+# SKIP_SCHEMA_INIT=true makes the Go services trust the existing prod schema and
+# run NO DDL. The Go tracker writes prod `dereth`; inventory-go writes prod
+# `inventory_db`; the (still Python) rare/chat bot is repointed at the Go
+# tracker's /ws/live (proven posting path, fed by Go data).
+services:
+  dereth-tracker-go:
+    environment:
+      READ_ONLY: "false"
+      SKIP_SCHEMA_INIT: "true"
+      SHARED_SECRET: "${SHARED_SECRET}"
+      SHARED_SECRET_LEGACY: "${SHARED_SECRET_LEGACY:-}"
+      DISCORD_ACLOG_WEBHOOK: "${DISCORD_ACLOG_WEBHOOK}"
+
+  inventory-go:
+    environment:
+      READ_ONLY: "false"
+      SKIP_SCHEMA_INIT: "true"
+
+  discord-rare-monitor:
+    environment:
+      DERETH_TRACKER_WS_URL: "ws://dereth-tracker-go:8770/ws/live"