feat: redesign match play and add broadcast tooling

scripts/sanitize-dev-copy.sql

@@ -0,0 +1,35 @@
+-- Run only after restoring a production snapshot into an isolated dev database.
+-- Preserve public osu identities, matches, mappools, and tournaments while
+-- preventing copied credentials, sessions, and contact addresses from working.
+BEGIN;
+
+DO $$
+BEGIN
+	IF current_database() !~ '^vash_dev(_refresh_[0-9]+)?$' THEN
+		RAISE EXCEPTION 'Refusing to sanitize non-dev database %', current_database();
+	END IF;
+END $$;
+
+DELETE FROM session;
+DELETE FROM verification;
+
+UPDATE account
+SET access_token = NULL,
+	refresh_token = NULL,
+	id_token = NULL,
+	access_token_expires_at = NULL,
+	refresh_token_expires_at = NULL,
+	password = NULL,
+	profile = CASE WHEN jsonb_typeof(profile) = 'object'
+		THEN profile - 'email' - 'emailVerified' ELSE profile END;
+
+UPDATE "user"
+SET email = 'dev+' || md5(id) || '@identity.invalid',
+	contact_email = NULL,
+	email_verified = false;
+
+DELETE FROM broadcast_destination;
+UPDATE broadcast_channel SET agent_token_hash = NULL, live = false;
+DELETE FROM broadcast_session;
+
+COMMIT;