games_ws_backend: retire the golf hub

bazel/go.MODULE.bazel

@@ -14,7 +14,6 @@ go_deps.gazelle_default_attributes(
 go_deps.from_file(go_mod = "//:go.mod")
 use_repo(
     go_deps,
-    "com_github_golang_jwt_jwt_v5",
     "com_github_google_uuid",
     "com_github_gorilla_websocket",
     "com_github_jackc_pgx_v5",

deploy/consolidated/Caddyfile

@@ -122,10 +122,6 @@ api.muchq.com {
 		path /games/v1/thoughts-ws
 	}
 
-	@ws_golf {
-		path /games/v1/golf-ws
-	}
-
 	@post_golf_v2_session {
 		method POST
 		path /games/v2/session
@@ -175,9 +171,6 @@ api.muchq.com {
 	handle @ws_thoughts {
 		reverse_proxy games_ws_backend:8080
 	}
-	handle @ws_golf {
-		reverse_proxy games_ws_backend:8080
-	}
 	handle @post_golf_v2_session {
 		reverse_proxy golf_hub:8089
 	}

deploy/consolidated/Caddyfile.local

@@ -72,10 +72,6 @@
 		path /games/v1/thoughts-ws
 	}
 
-	@ws_golf {
-		path /games/v1/golf-ws
-	}
-
 	@post_golf_v2_session {
 		method POST
 		path /games/v2/session
@@ -109,9 +105,6 @@
 	handle @ws_thoughts {
 		reverse_proxy localhost:8080
 	}
-	handle @ws_golf {
-		reverse_proxy localhost:8080
-	}
 	handle @post_golf_v2_session {
 		reverse_proxy localhost:8089
 	}

deploy/consolidated/README.md

@@ -113,8 +113,8 @@ To ship a change without restarting the whole stack:
 
 ```
 SERVICE             DESCRIPTION
-games_ws_backend    Websocket backend for v1 games
-golf_hub            Golf v2 hub on smithy event streams (/games/v2/*)
+games_ws_backend    Websocket backend for thoughts
+golf_hub            Golf hub on smithy event streams (/games/v2/*)
 mcpserver           Model Context Protocol server
 ...
 ```

deploy/consolidated/compose.yaml

@@ -47,7 +47,7 @@ services:
   games_ws_backend:
     image: ghcr.io/muchq/games_ws_backend:${GAMES_WS_BACKEND_SHA:-${DEPLOY_SHA:-latest}}
     labels:
-      com.muchq.description: "Websocket backend for v1 games"
+      com.muchq.description: "Websocket backend for thoughts"
     restart: always
     logging: *default-logging
     ports:
@@ -62,20 +62,19 @@ services:
           cpus: '0.25'
           memory: 256M
 
-  # The smithy event-stream golf service (/games/v2/*, MoonBase#1187);
-  # serves the v2 beta while games_ws_backend keeps serving v1.
+  # The smithy event-stream golf service (/games/v2/*).
   golf_hub:
     image: ghcr.io/muchq/golf_hub:${GOLF_HUB_SHA:-${DEPLOY_SHA:-latest}}
     labels:
-      com.muchq.description: "Golf v2 hub on smithy event streams (/games/v2/*)"
+      com.muchq.description: "Golf hub on smithy event streams (/games/v2/*)"
     restart: always
     logging: *default-logging
     ports:
       - "8089:8089"
     environment:
       PORT: "8089"
       # CSWSH defense: the play socket admits only the deployed UI's
-      # origins (parity with the Go hub's allowlist).
+      # origins.
       ALLOWED_ORIGINS: https://muchq.com,https://www.muchq.com
       TRUSTED_PROXY_CIDRS: *caddy_ip
       # Credentials live in the hub's own database on the shared postgres

deploy/consolidated/deploy_config_test.go

@@ -2150,7 +2150,6 @@ func catchAllIsLastHandle(site []string, terminal string) (found bool, problem s
 // a rewrite of the block does not ship.
 var localRoutes = map[string]string{
 	"@ws_thoughts":          "localhost:8080",
-	"@ws_golf":              "localhost:8080",
 	"@post_golf_v2_session": "localhost:8089",
 	"@ws_golf_v2":           "localhost:8089",
 	"@post_portrait":        "localhost:8081",

domains/games/README.md

@@ -8,7 +8,7 @@ Game engines, services, and libraries.
 
 ## APIs
 
-- [**Golf Hub**](apis/golf_hub): smithy-cpp event-stream backend for the golf card game (v2).
+- [**Golf Hub**](apis/golf_hub): smithy-cpp event-stream backend for the golf card game.
 - [**Games WS Backend**](apis/games_ws_backend): WebSocket-based backend for real-time multiplayer games.
 - [**Mithril**](apis/mithril): Rust-based game service.
 - [**1d4.net**](apis/one_d4): Chess analysis service.

domains/games/apis/games_ws_backend/BUILD.bazel

@@ -7,9 +7,7 @@ go_library(
     importpath = "github.com/muchq/moonbase/domains/games/apis/games_ws_backend",
     visibility = ["//visibility:public"],
     deps = [
-        "//domains/games/apis/games_ws_backend/golf",
         "//domains/games/apis/games_ws_backend/hub",
-        "//domains/games/apis/games_ws_backend/players",
         "//domains/games/apis/games_ws_backend/thoughts",
     ],
 )

domains/games/apis/games_ws_backend/README.md

@@ -1,12 +1,11 @@
 # Game Server
 
-A real-time multiplayer, multitenant WebSocket game server.
+A real-time multiplayer WebSocket game server.
 
 ## Overview
 
-This server hosts multiple game backends on a single process, each on its own WebSocket endpoint:
+Each game backend is registered on its own WebSocket endpoint:
 
-- **[Golf](golf/)** (`/games/v1/golf-ws`) — a 4-card golf card game with rooms, JWT authentication, and session reconnection
 - **[Thoughts](thoughts/)** (`/games/v1/thoughts-ws`) — a chill 3D multiplayer vibe, playable at [muchq.com/thoughts](https://muchq.com/thoughts)
 
 ## Architecture
@@ -15,7 +14,6 @@ This server hosts multiple game backends on a single process, each on its own We
 main.go
 ├── hub/             # Shared WebSocket hub: client lifecycle, ping/pong, origin checks
 ├── players/         # Player ID generators (whimsical for prod, deterministic for tests)
-├── golf/            # Golf game hub + game logic + JWT auth
 └── thoughts/        # Thoughts game hub + game logic
 ```
 
@@ -36,7 +34,7 @@ Games receive raw messages via `GameMessage`, manage their own state, and send r
 
 ### Client Identity
 
-Each WebSocket connection gets a UUID (`hub.Client.ID`) assigned at upgrade time. Games build their own identity layer on top — golf uses JWT-based player sessions that persist across reconnections.
+Each WebSocket connection gets a UUID (`hub.Client.ID`) assigned at upgrade time. Games build their own identity layer on top.
 
 ## Running
 
@@ -69,5 +67,4 @@ deploy/consolidated/deploy.sh
 ## Security
 
 - **Origin validation**: Production only allows `muchq.com`, `www.muchq.com`, and `thoughts.muchq.com` over HTTPS
-- **JWT authentication** (golf): HMAC-SHA256 tokens with algorithm validation to prevent confusion attacks
 - **Server-assigned IDs**: Player IDs are generated server-side, never accepted from clients