PC3 Phase 3.2: real age verification (date of birth, not a checkbox)

POST /api/auth/register now requires a real date_of_birth (ISO YYYY-MM-DD).
The server computes age (auth.calculate_age) and rejects under-18s with 403;
a future/nonsensical date is 400. The DOB is stored and surfaced only to
that user (/api/auth/me).

Still self-attested (a user can enter a false DOB) -- but a concrete,
stored, legally-meaningful data point and the seam for a future ID-check
pass. Encryption-at-rest for the column and the Tier-2 hook are not done;
the limitation is stated plainly in docs/architecture/content_moderation.md 5.2.

- auth.py: RegisterRequest.date_of_birth (date); MIN_AGE=18; register()
  computes + enforces; UserResponse.date_of_birth typed `date | None`
  (the old `str | None` would have 500'd /me once a DOB was actually stored).
- api_client.gd / main_menu.gd: the Over18 checkbox is now a
  "Date of birth (YYYY-MM-DD)" field with a client-side sanity check.
- tests: test_auth_age_gate.py rewritten around the endpoint + age math
  (adult/minor/exactly-18/future-dob/stored); ~25 over_18 references across
  6 backend test files + 6 game smoke tests updated. Backend 74 passed;
  game smokes green (auth 6/6, menu_full_flow 12/12, e2e 4/4, etc.);
  fresh-clone boot PASS.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015jtxAiu5dAW4WxCNdGkrkJ

scripts/main_menu.gd

@@ -35,7 +35,7 @@ var _auth_mode_label: Label
 var _username_edit: LineEdit
 var _password_edit: LineEdit
 var _email_edit: LineEdit
-var _over_18_check: CheckBox
+var _dob_edit: LineEdit
 var _auth_button: Button
 var _status_label: Label
 var _welcome_label: Label
@@ -59,7 +59,7 @@ func _ready() -> void:
 	_username_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit
 	_password_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit
 	_email_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/EmailEdit
-	_over_18_check = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/Over18Check
+	_dob_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/DobEdit
 	_auth_button = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton
 	_status_label = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthStatusLabel
 	_welcome_label = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/WelcomeLabel
@@ -115,7 +115,7 @@ func _show_authenticated(username: String) -> void:
 	_username_edit.visible = false
 	_password_edit.visible = false
 	_email_edit.visible = false
-	_over_18_check.visible = false
+	_dob_edit.visible = false
 	_auth_button.visible = false
 	_auth_mode_label.visible = false
 	_play_button.disabled = false
@@ -131,8 +131,8 @@ func _reset_to_logged_out() -> void:
 	_status_label.visible = false
 	_welcome_label.visible = false
 	_email_edit.visible = false
-	_over_18_check.visible = false
-	_over_18_check.button_pressed = false
+	_dob_edit.visible = false
+	_dob_edit.text = ""
 	_play_button.disabled = true  # Gate play behind successful auth.
 	_customize_button.disabled = true
 	_update_auth_mode_ui()
@@ -158,6 +158,19 @@ func _on_quit_button_pressed() -> void:
 	get_tree().quit()
 
 
+## Loose client-side check -- YYYY-MM-DD, a real calendar date, not in the
+## future. The backend does the authoritative age computation.
+func _is_valid_dob(dob: String) -> bool:
+	var m := RegEx.new()
+	m.compile("^\\d{4}-\\d{2}-\\d{2}$")
+	if m.search(dob) == null:
+		return false
+	var parts := dob.split("-")
+	var d := {"year": int(parts[0]), "month": int(parts[1]), "day": int(parts[2]), "hour": 0, "minute": 0, "second": 0}
+	var unix := Time.get_unix_time_from_datetime_dict(d)
+	return unix > 0 and unix < Time.get_unix_time_from_system()
+
+
 # ─── Auth panel toggle ────────────────────────────────────────────────────────
 
 func _on_login_button_pressed() -> void:
@@ -184,12 +197,12 @@ func _update_auth_mode_ui() -> void:
 		_auth_mode_label.text = "Register"
 		_auth_button.text = "Register"
 		_email_edit.visible = true
-		_over_18_check.visible = true
+		_dob_edit.visible = true
 	else:
 		_auth_mode_label.text = "Login"
 		_auth_button.text = "Login"
 		_email_edit.visible = false
-		_over_18_check.visible = false
+		_dob_edit.visible = false
 
 
 # ─── Auth submission ──────────────────────────────────────────────────────────
@@ -216,8 +229,9 @@ func _on_auth_button_pressed() -> void:
 		if email == "":
 			_show_status("Email is required.")
 			return
-		if not _over_18_check.button_pressed:
-			_show_status("You must confirm you are 18 or older to register.")
+		var dob := _dob_edit.text.strip_edges()
+		if not _is_valid_dob(dob):
+			_show_status("Enter your date of birth as YYYY-MM-DD.")
 			return
 
 		_auth_button.disabled = true
@@ -225,7 +239,7 @@ func _on_auth_button_pressed() -> void:
 		_is_authenticating = true
 		_clear_status()
 
-		var result := await ApiClient.register(username, email, password, true)
+		var result := await ApiClient.register(username, email, password, dob)
 		await _on_auth_complete(result)
 	else:
 		_auth_button.disabled = true
@@ -251,7 +265,7 @@ func _on_auth_complete(result: Dictionary) -> void:
 		_username_edit.visible = false
 		_password_edit.visible = false
 		_email_edit.visible = false
-		_over_18_check.visible = false
+		_dob_edit.visible = false
 		_auth_button.visible = false
 		_auth_mode_label.visible = false
 		_status_label.visible = false