feat(landing): join-flow rework, player rosters, account page, mod list

Execute plan/18 (WS1-6) + plan/17.

- WS1: homepage join = 3 steps off packwiz (register -> UlicraftLauncher
  -> join); per-OS downloads from a synced launcher-manifest.json (schema +
  example committed); Fjord moved to its own /fjord page. Drop packwizUrl.
- WS2/3: mc-status gains an isolated /players endpoint (admin login ->
  Drasl GET /players, own client+TTL+token cache, never blocks the status
  path); online + registered rosters render shared name+avatar tiles;
  AVATAR_MODE env (default headiso).
- WS4: /account skin CRUD via browser-direct Drasl (login -> upload ->
  reset), in-memory token, players[0]; register relinks "Manage it here".
- WS5: footer link to status.${BASE_DOMAIN} in every footer.
- WS6: tooling/build-modlist.py generates mods.json + extracted logos from
  the distribution forgemods; ModList.astro renders a flat list; stat tile
  fed from the count.

Manifest/mods loaders read at build with a process.cwd() fallback (the
import.meta.url-only path does not resolve in Astro's bundled build).

New env: AVATAR_MODE, DRASL_ADMIN_USERNAME, DRASL_ADMIN_PASSWORD (mc-status
only). Generated mods.json / launcher-manifest.json / logos are gitignored;
.example.json files document the shapes. Build: 12 pages; mc-status builds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -15,6 +15,19 @@ RCON_PASSWORD=change-me-to-something-random
 # and the landing build (-> show/hide the invite-code field). Default: invite.
 REGISTRATION_MODE=invite
 
+# NMSR avatar render mode for the landing's avatar tiles (online players +
+# Members roster). Read by the landing BUILD (data/site.ts) only. Avatar URL =
+# https://avatar.${BASE_DOMAIN}/<mode>/<uuid>?size=N. e.g. headiso | head | fullbody.
+AVATAR_MODE=headiso
+
+# Drasl admin creds for the registered-players roster (/api/mcstatus/players).
+# Consumed ONLY by the mc-status container (server-side login → sanitized
+# [{uuid,name}] list); these NEVER reach the browser. Use a DEDICATED, rotatable
+# admin account (Drasl has no read-only role) to limit blast radius. Leave blank
+# to disable the roster (the Members grid then just shows its empty state).
+DRASL_ADMIN_USERNAME=
+DRASL_ADMIN_PASSWORD=
+
 # caddy host-published port. The host's own nginx terminates TLS and
 # reverse-proxies to caddy by Host header (nginx/ulicraft-caddy.conf.tmpl), so
 # bind caddy to a high localhost-only port — only nginx should reach it.