Add lobby and pack concept.

internal/server/bots.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"errors"
 	"log/slog"
 	"math/rand/v2"
 	"time"
@@ -20,6 +21,28 @@ var botDifficulty = map[string]struct {
 	"hard":   {1.00, "Robo Ace"},
 }
 
+// requireHost authorizes a lobby-management action: only the host (seat 0)
+// may set the pack, add or remove players, or start the game. Identity lives
+// at this trust boundary, keeping the game engine free of it.
+func requireHost(g *game.Game, playerID string) error {
+	if len(g.Players) == 0 || g.Players[0].ID != playerID {
+		return errors.New("only the host can do that")
+	}
+	return nil
+}
+
+// addBot seats a computer opponent for a difficulty name, translating the
+// name to the engine's skill level. Capacity and phase are enforced by the
+// engine's AddPlayer.
+func addBot(g *game.Game, difficulty string) error {
+	bot, ok := botDifficulty[difficulty]
+	if !ok {
+		return errors.New("unknown bot difficulty")
+	}
+	_, err := g.AddBot(bot.name, bot.level)
+	return err
+}
+
 // commitLocked is the one path every game mutation goes through: bots update
 // their memories from the new public state, the game is persisted, every
 // client gets its view, and the next bot move (if any) is scheduled. Callers