Server 2.10.4: HTTPS for the web panel and hostile client hardening

- Panel over HTTPS on the game port (TLS handshake detected like HTTP); self-signed
  certificate in data/panel_cert.pfx (fingerprint in the log) or an own PFX
  (PanelCertificatePath); remote HTTP is redirected to HTTPS (not locally / behind
  a proxy); cookie Secure over HTTPS; PanelHttps=false turns it off
- Panel login: also locked per user name (16 failures / 15 min), failure lists
  bounded, user names in the log without control characters
- panel_users.json, panel_sessions.json, server.json, certificate: owner-only on Linux
- Players: names/chat without control or direction characters (no fake log lines),
  no '<' '>' in names; '* ' system-style chat, msco.* messages (time/weather) and
  MSCO_INSTALL only from admins; NaN/absurd money changes dropped (could break the
  shared money for good)
- Extra headers: Permissions-Policy, Cross-Origin-Opener-Policy
- 11 new tests (165 pass)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ServerHost.cs

@@ -468,7 +468,9 @@ public sealed class ServerHost
                 {
                     n = await tcp.Client.ReceiveAsync(buffer, SocketFlags.Peek, timeout.Token);
                     if (n == 0) { tcp.Close(); return; }
-                    if (n >= 4 || buffer[0] < 'A' || buffer[0] > 'Z') break; // kein Buchstabe = sicher das Spiel
+                    if (n >= 4) break;
+                    // TLS (HTTPS zum Panel) beginnt mit 0x16 0x03 - auf die ersten Bytes warten; sonst kein Buchstabe = Spiel
+                    if (buffer[0] != 0x16 && (buffer[0] < 'A' || buffer[0] > 'Z')) break;
                     await Task.Delay(15, timeout.Token);
                 }
             }
@@ -482,6 +484,11 @@ public sealed class ServerHost
                 await Panel.RelayAsync(tcp);
                 return;
             }
+            if (PanelTls.LooksLikeTls(buffer, n))
+            {
+                await Panel.RelayAsync(tcp, tls: true);
+                return;
+            }
         }
 
         var server = Server;