peyaj's Auth [Paper/Velocity]

Fixes

• Fixed Floodgate Bedrock checks to use official API validation, preventing prefix spoofing and account takeovers.
• Fixed database error handling across proxy auth commands so database outages fail safely.
• Fixed two-factor authentication on Velocity proxies so 2FA codes are verified directly during proxy login.
• Fixed logout command to de-authenticate players on backend servers and return them to the limbo waiting room.
• Fixed brute-force protection to track failed attempts and disconnect players who exceed limits.
• Fixed duplicate listeners to resolve command conflicts and allow disconnect for unauthenticated players.
• Fixed title display timings so fade-in, stay, and fade-out durations are properly applied.
• Fixed prompt spam by removing redundant limbo auth reminders and accurately distinguishing premium accounts.

Improvements

• Added support for session duration and remember-login settings from proxy configuration.
• Added startup warnings when the auth bridge secret is left empty.
• Improved login command concurrency to prevent race conditions during rapid authentication attempts.
• Improved captcha generation by using a cryptographically secure random generator.