games: the poker engine learns there can be more than one of you

Phase C, the engine half: hold'em becomes multiway, and the redaction that was a
bug-in-one-handler becomes the security boundary the plan warned it would.

- const You is gone. A table is a list of seats and which are human is a per-seat
  property, not the fixed index zero. New(tier, []SeatConfig, ...) seats the ring;
  SoloSeats builds the old one-human-plus-bots shape the solo handler still opens.
- ApplyMove(state, seat, move) — seat identity enters the engine in exactly one
  place; every helper below already worked on indices. The advance loop stops at
  any human (not just seat 0), so one request plays the bots and hands control
  back at whichever person is next to act.
- deal() now emits every seat's hole cards. The engine cannot redact a stream it
  doesn't know the audience of, so it stops trying: the view layer builds each
  viewer's redacted copy. viewHoldem/viewHoldemEvents take a viewerSeat.
- Rake attributed to Paid whenever a *human* wins, not just seat 0 — real house
  income is rake off any player's pot, and bot pots are house-vs-house.
- Bust is per-seat: at a solo table it still ends the session (PhaseDone), at a
  shared one a busted human just goes Out and the table plays on.

Tests, three ways, all green:
- the solo suite unchanged as a regression guard (a test-local You=0 alias);
- TestMultiwayChipsAreConserved — 100 games, two humans at seats 0 and 2, chips
  counted after every move, proving the reshape actually plays;
- TestHoldemViewNeverLeaksAnotherSeatsCards — renders every seat's view and event
  stream at every street and greps for anyone else's cards. Mutation-tested: undo
  the redaction and it fails on the preflop deal.

No handlers rewired yet — the solo path still calls New(SoloSeats(...)) and renders
for seat 0, so nothing a player sees has changed. The table cutover is next.

Claude-Session: https://claude.ai/code/session_013M5nD7PgUboJXoDcYHzpuJ

internal/web/games_holdem.go

@@ -44,6 +44,10 @@ type holdemSeatView struct {
 	Won   int64      `json:"won,omitempty"`
 }
 
+// soloViewer is the seat the still-solo handler renders for: the one human, at
+// zero. The shared-table path passes the seat of whoever is actually watching.
+const soloViewer = 0
+
 var seatStates = map[holdem.SeatState]string{
 	holdem.Active: "active",
 	holdem.Folded: "folded",
@@ -81,7 +85,17 @@ type holdemView struct {
 	Payout   int64 `json:"payout,omitempty"`
 }
 
-func viewHoldem(g holdem.State) holdemView {
+// viewHoldem renders the table as one seat may see it. viewer is which seat is
+// looking — their cards are the only hole cards it will ever put in the payload
+// (until a showdown turns the rest over), and the action panel is filled in only
+// when it is that seat's turn.
+//
+// This is the security boundary. Before SSE a missed check here leaked one bot's
+// cards to one player through a bug in one handler; now the same view fans to
+// every subscriber's stream, so a seat that renders anyone else's hole card fans
+// it to the whole table. TestHoldemViewNeverLeaksAnotherSeatsCards renders every
+// seat's view at every street and greps for cards that are not theirs.
+func viewHoldem(g holdem.State, viewer int) holdemView {
 	v := holdemView{
 		Tier:     g.Tier,
 		Button:   g.Button,
@@ -90,9 +104,9 @@ func viewHoldem(g holdem.State) holdemView {
 		Pot:      g.Total(),
 		ToAct:    g.ToAct,
 		Phase:    string(g.Phase),
-		Stack:    g.Seats[holdem.You].Stack,
+		Stack:    g.Seats[viewer].Stack,
 		BoughtIn: g.BoughtIn,
-		Rake:     g.Paid, // the part you actually paid, not the part the table lifted
+		Rake:     g.Paid, // the part players actually paid, not the part the table lifted
 		Payout:   g.Payout,
 	}
 	for _, p := range g.Side {
@@ -106,22 +120,22 @@ func viewHoldem(g holdem.State) holdemView {
 		v.Board = append(v.Board, viewCard(c))
 	}
 
-	// The wall. A bot's hand crosses the wire in exactly one situation — the hand
-	// was shown down and they did not fold — because that is the only situation in
-	// which a player at a real table would be looking at it.
+	// The wall. Another seat's hand crosses the wire in exactly one situation — the
+	// hand was shown down and they did not fold — because that is the only situation
+	// in which a player at a real table would be looking at it.
 	shown := g.Street == holdem.Showdown
 	for i, p := range g.Seats {
 		seat := holdemSeatView{
 			Name:  p.Name,
 			Bot:   p.Bot,
-			You:   i == holdem.You,
+			You:   i == viewer,
 			Stack: p.Stack,
 			Bet:   p.Bet,
 			State: seatStates[p.State],
 			Pos:   g.Position(i),
 			Won:   p.Won,
 		}
-		mine := i == holdem.You
+		mine := i == viewer
 		dealt := p.State != holdem.Out && p.Hole[0].Rank != 0
 		if dealt && (mine || (shown && p.State != holdem.Folded)) {
 			seat.Cards = []cardView{viewCard(p.Hole[0]), viewCard(p.Hole[1])}
@@ -129,14 +143,14 @@ func viewHoldem(g holdem.State) holdemView {
 		v.Seats = append(v.Seats, seat)
 	}
 
-	if g.Phase == holdem.PhaseBetting && g.ToAct == holdem.You {
-		v.Owed = g.Owed(holdem.You)
+	if g.Phase == holdem.PhaseBetting && g.ToAct == viewer {
+		v.Owed = g.Owed(viewer)
 		v.CanCheck = v.Owed == 0
-		v.CanRaise = g.CanRaise(holdem.You)
-		v.MinRaise = g.MinRaiseTo(holdem.You)
-		v.MaxRaise = g.MaxRaiseTo(holdem.You)
+		v.CanRaise = g.CanRaise(viewer)
+		v.MinRaise = g.MinRaiseTo(viewer)
+		v.MaxRaise = g.MaxRaiseTo(viewer)
 	}
-	if top := g.Tier.MaxBuy - g.Seats[holdem.You].Stack; top > 0 {
+	if top := g.Tier.MaxBuy - g.Seats[viewer].Stack; top > 0 {
 		v.MaxTopUp = top
 	}
 	return v
@@ -154,16 +168,22 @@ type holdemEventView struct {
 	Text   string     `json:"text,omitempty"`
 }
 
-func viewHoldemEvents(evs []holdem.Event) []holdemEventView {
+// viewHoldemEvents redacts the engine's script for one viewer. The engine emits
+// every seat's hole cards now (it cannot know who a shared stream is for), so
+// this is where the cards that are not the viewer's are stripped — turning a
+// "deal seat 3 these two cards" beat into "deal seat 3 two face-down cards".
+//
+// A card may ride an event only if it is a board card (Seat < 0), the viewer's
+// own, or a hand being shown down. Everything else is nulled here, and a missed
+// case is the leak that fans one seat's hole card to every subscriber.
+func viewHoldemEvents(evs []holdem.Event, viewer int) []holdemEventView {
 	out := make([]holdemEventView, 0, len(evs))
 	for _, e := range evs {
 		v := holdemEventView{Kind: e.Kind, Seat: e.Seat, Amount: e.Amount, Total: e.Total, Text: e.Text}
 		for _, c := range e.Cards {
 			v.Cards = append(v.Cards, viewCard(c))
 		}
-		// A card may ride an event only if it is the board, your own hand, or a hand
-		// being shown down. Anything else is a bot's business.
-		if len(v.Cards) > 0 && e.Seat >= 0 && e.Seat != holdem.You && e.Kind != "show" {
+		if len(v.Cards) > 0 && e.Seat >= 0 && e.Seat != viewer && e.Kind != "show" {
 			v.Cards = nil
 		}
 		out = append(out, v)
@@ -215,7 +235,7 @@ func (s *Server) handleHoldemSit(w http.ResponseWriter, r *http.Request) {
 	}
 
 	seed1, seed2 := newSeeds()
-	g, evs, err := holdem.New(tier, req.Bots, req.BuyIn, blackjack.DefaultRules().RakePct, seed1, seed2)
+	g, evs, err := holdem.New(tier, holdem.SoloSeats(tier, req.Bots, req.BuyIn), blackjack.DefaultRules().RakePct, seed1, seed2)
 	if err != nil {
 		_ = storage.Award(user, req.BuyIn) // nobody sat down, so nothing was bought
 		slog.Error("games: holdem sit", "user", user, "err", err)
@@ -276,7 +296,7 @@ func (s *Server) handleHoldemMove(w http.ResponseWriter, r *http.Request) {
 		topped = move.Amount
 	}
 
-	next, evs, err := holdem.ApplyMove(g, move)
+	next, evs, err := holdem.ApplyMove(g, soloViewer, move)
 	if err != nil {
 		if topped > 0 {
 			_ = storage.Award(user, topped) // the top-up didn't happen
@@ -341,9 +361,9 @@ func (s *Server) persistHoldem(w http.ResponseWriter, user string, g holdem.Stat
 	// A closed session is gone from storage, so the table view has none to show —
 	// but the browser still needs the last board to land the verdict on.
 	if done {
-		hv := viewHoldem(g)
+		hv := viewHoldem(g, soloViewer)
 		v.Holdem = &hv
 	}
-	v.HoldemEvents = viewHoldemEvents(evs)
+	v.HoldemEvents = viewHoldemEvents(evs, soloViewer)
 	writeJSON(w, v)
 }