Connect Discover: add verified opt-in publishing and privacy controls

[robinbraemer]

Human need

Server owners need a safe “publish once” workflow. Players need confidence that a listing represents an endpoint controlled by the claimed owner. Private endpoints must never become public through defaults or migration mistakes.

Outcome

Add verified, explicit, reversible publication controls and a listing editor to the Minekube dashboard.

Design constraints

• Import/ownership verification and organization authorization are prerequisites.
• Publication is a positive state transition with an exact preview of public fields.
• Replace the legacy negative PREVENT_BROWSER_ENDPOINT_LISTING model for new listings; migration must fail closed.
• Separate draft, published, suspended, unpublished, and ownership-disputed states.
• Use organization roles for edits and publish/unpublish permissions.
• Record a privacy-safe audit trail for every state and metadata change.
• A published listing always exposes the verified Minekube play address; a verified custom domain may be preferred visually.

Acceptance criteria

• A newly created, imported, random, Share, or existing endpoint is not publicly listed without an authorized publish action.
• Migration tests prove legacy options cannot accidentally publish endpoints.
• Owners can preview the exact public API and page representation before publishing.
• Validation covers names, descriptions, media, links, categories, versions, languages, addresses, modpack requirements, and edition support.
• Concurrent edits and publish/unpublish requests have explicit conflict behavior.
• Unpublish and organization/ownership removal revoke public visibility and purge caches/search documents within a documented bound.
• Unauthorized role, cross-org, stale-session, CSRF, replay, and direct API attempts cannot mutate publication state.
• Owners can export their listing metadata and audit history.
• The dashboard clearly explains that public discovery does not bypass authentication, allowlists, or endpoint admission.

Non-goals

• Automatically publishing an endpoint because it is online.
• Publicly exposing organization membership or endpoint credentials.
• Letting a listing claim an unverified custom domain.