games: the wire the euros cross

Three bearer-authed endpoints and gogobee can work the border: poll what's
waiting, claim a row, report what happened to the money. The storage layer
underneath was already done; this is the transport, and deliberately nothing
more.

All three are idempotent, because the thing on the other end of them is a
retrying queue and the thing they move is money. A verdict delivered three
times creates chips once. A rejected buy-in moves nothing and clears the
pending amount so it stops eating the table cap. A cash-out gogobee couldn't
pay gives the chips back rather than vanishing them from both sides.

A verdict for a row Pete has never heard of is a 400, not a shrug: gogobee has
by then moved real euros against it, and no amount of retrying invents the
missing row. Under the contract the adventure seam set, a 400 parks it in
gogobee's queue where a human can find it.

internal/web/server.go

@@ -202,6 +202,14 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
 	// /adventure/{guid}, so the two patterns never overlap.
 	mux.HandleFunc("GET /adventure/art/{type}", s.handleAdventureArt)
 
+	// The euro/chip border. gogobee polls pending, claims a row, moves the euros,
+	// and pushes the verdict back. Bearer-authed on the same ingest token as the
+	// adventure seam, so like it, these sit outside the sign-in block — the caller
+	// is a machine on the tailnet, not a browser.
+	mux.HandleFunc("GET /api/games/escrow/pending", s.handleEscrowPending)
+	mux.HandleFunc("POST /api/games/escrow/claim", s.handleEscrowClaim)
+	mux.HandleFunc("POST /api/games/escrow/settled", s.handleEscrowSettled)
+
 	if s.auth != nil {
 		mux.HandleFunc("GET /auth/login", s.auth.handleLogin)
 		mux.HandleFunc("GET /auth/callback", s.auth.handleCallback)