One composition for casino control — tenants, credentials, and battle ops — not a generic AI dashboard.
Issue and revoke sbk_ API keys with scoped battles, games, and viewer mint.
Inspect lobbies, seat attempts, HLS outputs, and cancel stuck OPEN battles.
Viewer WS tokens, signing-key rotation, and HMAC result webhooks per casino.
HttpOnly SameSite sessions, TOTP, and role permissions scoped by X-Tenant-Id.