Server Login

# Server Login 1.0.3 — first CurseForge release

Beta. Works and is tested, but new. Back up your world before installing and report anything
that breaks.

**Requires:** Minecraft 1.20.1, Forge 47.4.10 or newer, `online-mode=false`.
**Server-side only** — players join with the vanilla launcher and install nothing.

## What it does

- Players register with `/login <password> <password>` and log in with `/login <password>`.
  `/l` is a shortcut. Also `/changepassword` and `/logout`.
- Until a player logs in they cannot move, chat, attack, open containers or interact with
  the world. No lobby, no teleport — they stay where they logged off.
- Passwords are stored as PBKDF2-HMAC-SHA256, random salt per account, 600,000 iterations by
  default. Never written in plain text, not in the account file and not in the log.
- Per-account lockout after repeated wrong passwords, plus server-wide and per-address rate
  limits on password hashing.
- Fail-closed packet gate: unauthenticated connections are denied by default, with an allow
  list for the login commands and for plugin channels that handshake on join. Simple Voice
  Chat is allowed out of the box.
- Admin commands (permission level 3): `/auth count`, `/auth status`, `/auth remove`,
  `/auth queue`, `/auth kick`. `/auth remove` is the forgotten-password reset.
- LuckPerms context `serverlogin:authenticated`.
- Accounts live in `world/serverlogin/users.json` — back it up with the world.

## New in 1.0.3

- English and Russian message catalogues. Set `general.language` in
  `config/serverlogin-common.toml`. Default is `en_us`; use `"ru_ru"` for the previous wording.
- Any message can be rewritten per server in `config/serverlogin/lang/<language>.json`,
  no rebuild needed.
- Diagnostics are off by default (`diagnostics.verboseLogging`,
  `diagnostics.logDisconnectStacks`, `diagnostics.joinWatchSeconds = 0`). An ordinary
  disconnect now logs at INFO; kicks and network errors still log at WARN.
- Forge update checker metadata, so servers get a notice when a newer build is published.
- Test classes are excluded from the release JAR.
- Removed the Settler Wagon compatibility layer and its optional dependency.

Full changelog: https://github.com/iwosw/server-login/blob/main/CHANGELOG.md
Issues: https://github.com/iwosw/server-login/issues
MIT licensed.