Accounts, login and alpha keys

Today Login { name } creates or takes any character by its name, with no password. An alpha needs accounts.

• An account service: sign-up with an alpha key, sign-in (email link or password; an existing identity provider is fine), session tokens the gateways verify, characters per account (a slot limit), name reservation and naming rules, bans.
• Alpha keys: issued to waitlist subscribers in waves (Kit tags, #99), one account per key, revocable.
• Protocol: Login takes a token instead of a bare name; Resume stays.
• Bots are players (#3): an account may run its characters from scripts with an API token (limits in abuse-protection).
• The privacy page and terms cover the new data (alpha-launch).

Done when nobody can play without a key, a tester's characters survive a wipe-free week, and the load test logs in through the same path.