Enhance API with OIDC support, including login and callback endpoints. Update environment variables for OIDC configuration in .env.example. Add new features to the catalog service for listing software families, Minecraft versions, and deployment regions. Implement server management actions such as kill, delete, and update in the servers module. Integrate feature flags for maintenance mode in server operations. Update pnpm-lock.yaml with new dependencies and versions.

docs/security/backup-encryption.md

@@ -0,0 +1,9 @@
+# Backup Encryption at Rest
+
+GameCloud backups are stored in S3-compatible object storage. Production deployments should enable:
+
+1. **Bucket SSE** — Server-side encryption (AES-256) on the backup bucket
+2. **Application envelope encryption** (roadmap) — Per-backup data keys wrapped with `ENCRYPTION_KEY`
+3. **Key rotation** — Documented in `docs/security/secrets.md`
+
+Current MVP stores backups without client-side encryption. Enable bucket policies before production.