Simplify and harden Capacity operations and group model

[remdui]

Summary

• replace the broad /capacity config ... control plane with a small operational interface
• keep only status/info, slot changes, per-server queueability, manual states and YAML reload
• make groups.<name>.servers the single source of group membership
• remove the duplicated per-server group setting from defaults, loading and persistence
• keep topology, unknown-server policy, timings, failure behavior and integration tuning config-only
• validate and apply the complete YAML policy as one immutable configuration generation
• harden admission, persistence, reload, lifecycle and command behavior after a full feature audit

Command interface

/capacity status
/capacity status group <group>
/capacity info <server>
/capacity slots proxy <capacity> [reserved]
/capacity slots gameplay <capacity> [reserved]
/capacity slots group <group> <capacity> [reserved]
/capacity slots server <server> <capacity> [reserved]
/capacity queueable <server> <true|false>
/capacity state <server> <open|draining|closed|offline|clear> [duration] [reason]
/capacity reload

The command surface no longer creates/deletes groups, moves group members, changes gameplay classification or initial states, mutates unknown-server behavior, or exposes lease/reconciliation/failure/Restart internals. Command arity and permission-aware suggestions are strict.

Group model

A group owns its members:

groups:
  survival:
    capacity: 250
    reserved_slots: 10
    servers:
      - survival
      - survival1
      - survival2

Individual server entries no longer contain group. Effective membership is derived from group lists. Startup and reload reject duplicate or malformed membership instead of silently changing policy.

Correctness audit improvements

• share one validated CapacityConfig instance across service and control plane
• load configuration and manual states from one YAML revision
• keep the previous live policy when validation fails
• reject malformed maps, lists, scalar types, identifiers, limits and durations
• reject negative limits and reserved capacity above total capacity
• make Redis snapshot channel, publisher and interval part of the validated policy
• reconfigure reconciliation, integrations and snapshot publication on reload
• reschedule runtime tasks safely and close them during feature shutdown
• serialize control-plane operations with shutdown and manual-state expiry
• wake queues after permissive configuration changes
• include configured, grouped and state-owned offline servers in snapshots and info output
• correctly distinguish clearing an existing manual state from an unchanged clear
• persist the complete validated policy before activating operational edits

Behavior

• slot and queueability commands persist to config.yml before becoming active
• omitted reserved capacity retains the existing value, clamped to the new total
• lowering capacity never kicks connected players
• group membership and advanced settings are changed in YAML and applied with /capacity reload
• /capacity info shows exact-server usage, group usage, queueability, gameplay participation, initial/effective state and manual state details
• Capacity remains YAML-only and creates no database tables or views

Validation

• focused tests cover canonical membership, duplicate rejection, strict types, invalid limits and durations, inherited group behavior, operational mutations, messaging policy, command permissions/arity, unchanged state clearing and offline-server snapshots
• Maven verification, coverage and checkstyle run in CI
• bundled Velocity acceptance boots the actual proxy, executes Capacity commands and verifies YAML persistence and clean shutdown