Checkout fixed.

Three fixes surfaced during the v2.9.2–2.9.4 batch playtest. All three were already applied to production by the playtester; this release commits and documents them.

• Analyst Pass checkout auth token — The checkout fetch in SecurityPlusLandingPage was missing the Authorization: Bearer header. The server could not identify the requesting user, causing auth failures at the checkout endpoint.
• Traefik API routing — The client-serving Traefik router was matching all /breach/* paths, including /breach/api/*. API requests were being routed to the Nginx frontend container instead of the API server, producing 405 and 502 errors on checkout. Added !PathPrefix(/breach/api) exclusion to the client router rules.
• Config self-healing — getConfig() now auto-calls loadConfig() if invoked before initialization, rather than throwing. Also added JWT_PRIVATE_KEY_FILE and JWT_PUBLIC_KEY_FILE env var support for Docker secrets.

Batch playtest result: analytics pipeline confirmed working end-to-end. trial.start and trial.mission.completed events are persisting to Postgres. The v2.10.0 direction gate opens June 24 with one week of clean funnel data.

The game is pay-what-you-can and open source. play.multiversestudios.xyz/breach/