Add story-graph narrative system (campaigns, editors, runtime)

Introduce the narrative layer as a directed story-flow graph: an authored
campaign a player walks node by node, replacing the interim slot/chapter model.

Schema (migrations 015-021):
- mysteries, global NPC templates + named poses, per-user playthroughs
- story_nodes, terminals, utterances (the flow graph and dialogue trees)
- clean cutover: retire slot cutscenes/chapters/seen_dialogue

Runtime:
- New Game creates a playthrough bound to the JWT identity (dev test-user fallback)
- advance() walks the graph cutscene -> dialogue -> level -> ..., auto-skipping gates
- branching dialogue: player choices route out through node terminals

Admin authoring:
- NPC editor: upload named poses to the gupi MinIO bucket
- mystery graph editor: vertical node canvas, wiring, entrypoint, delete-by-click
- dialogue crafter: utterance tree, Tab to add child, 1/2 speaker, undo

Content authored via the manifest importer / admin panel and seeded for Glass
Harbour. MinIO added to the dev stack; dev container runs in development mode.

Also includes a folder-widget simplification (removes open/close) and a
resolveUserId auth helper.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/auth.ts

@@ -26,6 +26,19 @@ export function hasAdminClaim(req: Request) {
   return req.authClaims?.role === 'admin' || req.authClaims?.isAdmin === true
 }
 
+/**
+ * Identity for a player's game state. Real players arrive with a JWT issued by
+ * glitch.university (verified through the key-exchange handoff); until that lands,
+ * an absent token resolves to a single fixed development user so the game is
+ * playable locally with no identity provider. Only this fallback branch changes
+ * when the external handoff is wired — the `user_id` column stays the same.
+ */
+export const DEVELOPMENT_TEST_USER_ID = 'osint-test-player'
+export function resolveUserId(req: Request): string {
+  const sub = req.authClaims?.sub
+  return typeof sub === 'string' && sub.length > 0 ? sub : DEVELOPMENT_TEST_USER_ID
+}
+
 export function requireAdmin(req: Request, res: Response, next: NextFunction) {
   if (!hasAdminClaim(req)) return res.status(403).json({ error: 'Administrator claim required' })
   next()