fix: return a one-time agent token on paid wallet joins

[sragss]

Fixes the main finding in #50: MPP wallet agents can join a paid game but can never issue a command afterward. /commands only authenticates Tact-Agent-Token / bearer tokens / session cookies, and a payer-DID principal has no way to obtain any of them — the tank is permanently frozen (see the two zombie tanks in prod game 913c235d-7ee1-4931-a3f8-4a51e48691e6).

Approach

When a verified MPP payer joins without an existing identity, mint a tact_agent_* token bound to the same wallet principal and return it once in the join response as agentToken. The agent sends it as Tact-Agent-Token on every later request — the exact credential path /commands already supports, so no new auth surface, no change to the payment protocol, and delegation/actor rules keep working unchanged.

POST /join (402 → pay → 200)
{ "command": {...}, "game": {...}, "agentToken": "tact_agent_…" }

• packages/db: attachPrincipalIdentity — insert an additional identity row for an existing principal.
• identity.ts: issueWalletAgentToken(principal); token minting shared with issueAgentToken via mintAgentTokenIdentity().
• Join route: issue the token only for paid joins where the principal came from payment.payer (token/cookie joins are unchanged). Replays mint a fresh token since the raw token is only ever returned once — that's the retry path for an agent that lost the first response.
• OpenAPI (JoinResult schema), x-guidance, README, and ARCHITECTURE updated to document the flow.

Notes

• Finding 2 in Paid MPP wallet agents are zombies after join; www host breaks MPP; join replays re-charge #50 (www 308 breaking MPP) looks already handled by 2248918 / 364a960.
• Finding 3 (idempotent join replays settle a fresh MPP charge each retry) is not addressed here — it needs either a pre-charge replay lookup (impossible for wallet joiners, whose identity comes from the payment itself) or refund handling, so leaving it to a follow-up.

pnpm lint && pnpm typecheck && pnpm test && pnpm build all pass on Node 24.

🤖 Generated with Claude Code

[vercel]

@sragss is attempting to deploy a commit to the rfs-personal Team on Vercel.

A member of the Team first needs to authorize it.