fix(peer): reject unsafe game IDs in state marker paths

Scanner finding #12 ("state marker path escape"). The per-game state
helpers in `state_paths.rs` joined a raw game ID below
`<state_dir>/games/`. The public `setup_done_path` was therefore usable
with an absolute or parent-containing ID by an embedding caller, and the
legacy migration discovered IDs from directory names in the user's games
folder and joined them unconditionally. Every shipping caller today
validates its ID or takes it from the catalog, so this was a footgun
rather than an exploited hole, but the fix is small and removes the
reliance on every future caller remembering the rule.

Add `validate_game_state_id`, which rejects separators and NUL and then
delegates to `lanspread_db::content_manifest::validate_portable_component`
(the catalog's own rules: no `.`/`..`, no trailing dot or space, no control
or Windows-reserved characters, no Windows device names). Reusing the
catalog validator rather than a private copy guarantees that any ID the
catalog can publish is accepted here and that the two cannot drift apart.

`setup_done_path` now returns `eyre::Result<PathBuf>`; it is the only
state path the embedding application calls with an ID that may originate
from UI input. `launch_settings_applied_path` leaves the public API and
becomes `pub(crate)`; the two public launch-settings entry points
(`apply_launch_settings_once`, `mark_launch_settings_applied`) validate
the ID before any filesystem work. `game_state_dir` carries a
`debug_assert!` documenting the contract for internal callers without
turning a bad ID into a release-build panic; the migration test suite
exercises that assertion in debug builds.

Behaviour changes:
- Legacy migration logs a warning, counts a failure and leaves the legacy
  marker in place for a games-folder directory whose name is not a
  portable game ID, instead of creating state below it. A new test covers
  a trailing-dot directory name.
- The Windows launcher ignores a run request whose ID `setup_done_path`
  rejects, with a warning, mirroring the existing invalid-ID early return.

Tests cover catalog-valid IDs that must remain accepted (embedded dots,
spaces, `console.txt`, `com10`, non-ASCII) and unsafe IDs that must be
rejected (empty, `.`, `..`, separators, NUL, trailing dot or space,
device names, `a:b`).

This ports the fallible API from the parallel security branch (lanspread2
commits 4146a0e and 9f26c63) onto the validator this branch already
exports from `lanspread-db`.

Test plan:
- `cargo test -p lanspread-peer --lib`: 491 passed.
- `just clippy`: clean.
- On Windows, launch a game with a valid ID and confirm the setup marker
  is still written under `<app-data>/games/<id>/setup_done`.

Claude-Session: https://claude.ai/code/session_01QRkCv4a4GqkajyamxmbSuA

crates/lanspread-peer/src/state_paths.rs

@@ -1,5 +1,7 @@
 use std::path::{Path, PathBuf};
 
+use lanspread_db::content_manifest::validate_portable_component;
+
 const PEER_IDENTITY_FILE: &str = "peer-identity-v1.json";
 const LOCAL_LIBRARY_DIR: &str = "local_library";
 const LOCAL_LIBRARY_INDEX_FILE: &str = "index.json";
@@ -55,21 +57,56 @@ pub(crate) fn local_library_index_path(state_dir: &Path) -> PathBuf {
         .join(LOCAL_LIBRARY_INDEX_FILE)
 }
 
+/// Joins a per-game state directory below `<state_dir>/games`.
+///
+/// Callers inside this crate pass IDs that come from the catalog or have
+/// already passed [`validate_game_state_id`]; the debug assertion documents
+/// that contract without turning a bad ID into a release-build panic.
 pub(crate) fn game_state_dir(state_dir: &Path, game_id: &str) -> PathBuf {
+    debug_assert!(
+        validate_game_state_id(game_id).is_ok(),
+        "game_state_dir called with an unvalidated game ID: {game_id:?}"
+    );
     games_state_dir(state_dir).join(game_id)
 }
 
+/// Rejects a game ID that could escape or alias its per-game state
+/// directory: separators, NUL, `.`/`..`, trailing dots or spaces, control or
+/// Windows-reserved characters and Windows device names.
+///
+/// The rules are the catalog's own portable component rules, so every ID a
+/// catalog can publish is accepted and the check cannot drift from the
+/// validator that admits game IDs in the first place.
+///
+/// # Errors
+///
+/// Returns the first violated rule.
+pub(crate) fn validate_game_state_id(game_id: &str) -> eyre::Result<()> {
+    if game_id.contains(['/', '\\', '\0']) {
+        eyre::bail!("game ID must be one path component: {game_id:?}");
+    }
+    validate_portable_component(game_id)
+}
+
 pub(crate) fn games_state_dir(state_dir: &Path) -> PathBuf {
     state_dir.join(GAMES_DIR)
 }
 
-#[must_use]
-pub fn setup_done_path(state_dir: &Path, game_id: &str) -> PathBuf {
-    game_state_dir(state_dir, game_id).join(SETUP_DONE_FILE)
+/// Path of the marker that records a completed one-time `game_setup` run.
+///
+/// This is the only state path exposed to embedding applications, whose game
+/// IDs may originate from UI input rather than the catalog, so it validates
+/// the ID before joining it below the state directory.
+///
+/// # Errors
+///
+/// Returns an error when `game_id` is not a single portable path component.
+pub fn setup_done_path(state_dir: &Path, game_id: &str) -> eyre::Result<PathBuf> {
+    validate_game_state_id(game_id)?;
+    Ok(game_state_dir(state_dir, game_id).join(SETUP_DONE_FILE))
 }
 
-#[must_use]
-pub fn launch_settings_applied_path(state_dir: &Path, game_id: &str) -> PathBuf {
+pub(crate) fn launch_settings_applied_path(state_dir: &Path, game_id: &str) -> PathBuf {
     game_state_dir(state_dir, game_id).join(LAUNCH_SETTINGS_APPLIED_FILE)
 }
 
@@ -188,4 +225,44 @@ mod tests {
             explicit
         );
     }
+
+    #[test]
+    fn setup_done_path_accepts_catalog_style_game_ids() {
+        let state_dir = Path::new("/state");
+        assert_eq!(
+            setup_done_path(state_dir, "game").expect("plain ID should be accepted"),
+            Path::new("/state/games/game/setup_done")
+        );
+        for game_id in ["game..v1 (final)", "console.txt", "com10", "Jörg"] {
+            assert!(
+                setup_done_path(state_dir, game_id).is_ok(),
+                "rejected catalog-valid game ID {game_id:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn setup_done_path_rejects_escaping_game_ids() {
+        let state_dir = Path::new("/state");
+        for game_id in [
+            "",
+            ".",
+            "..",
+            "../outside",
+            "/outside",
+            r"nested\game",
+            "game/child",
+            "game\0",
+            "game.",
+            "game ",
+            "NUL",
+            "con.txt",
+            "a:b",
+        ] {
+            assert!(
+                setup_done_path(state_dir, game_id).is_err(),
+                "accepted unsafe game ID {game_id:?}"
+            );
+        }
+    }
 }