Security checklist: daily reward streak (#1290)

Collecting practical notes so new server owners avoid the same traps. We keep configs in git and treat live changes as a hotfix branch. Client target: 12.x/13.x OTC builds with our custom modules disabled for the repro. Would you accept this as a draft tutorial under Learn Track?

Good call separating AAC auth from game auth cookies.

I would pin a status endpoint and keep Cloudflare off the game port.

Consider feature-flagging it for premium only during the first week.

For Windows hosts, mark the service recovery options or it will not auto-restart.