feat: implement safe leave, profile reset, and full game reset semantics

docs/openapi.yaml

@@ -73,6 +73,24 @@ paths:
         '400': { $ref: '#/components/responses/BadRequest' }
         '401': { $ref: '#/components/responses/Unauthorized' }
         '413': { $ref: '#/components/responses/PayloadTooLarge' }
+  /api/session/leave:
+    post:
+      summary: Release only the authenticated session
+      requestBody:
+        required: true
+        content: { application/json: { schema: { $ref: '#/components/schemas/GameRequest' } } }
+      responses: &recoveryResponses
+        '200': { $ref: '#/components/responses/RecoveryAccepted' }
+        '400': { $ref: '#/components/responses/BadRequest' }
+        '409': { $ref: '#/components/responses/Conflict' }
+        '413': { $ref: '#/components/responses/PayloadTooLarge' }
+  /api/session/profile-reset:
+    post:
+      summary: Release the authenticated session for a browser-local profile reset
+      requestBody:
+        required: true
+        content: { application/json: { schema: { $ref: '#/components/schemas/GameRequest' } } }
+      responses: *recoveryResponses
   /api/game/config:
     post:
       summary: Set the game mode (Player 1, lobby only)
@@ -131,6 +149,18 @@ paths:
             schema:
               $ref: '#/components/schemas/GameRequest'
       responses: *commandResponses
+  /api/game/reset:
+    post:
+      summary: Player-only full in-memory game reset
+      requestBody:
+        required: true
+        content: { application/json: { schema: { $ref: '#/components/schemas/GameRequest' } } }
+      responses:
+        '200': { $ref: '#/components/responses/RecoveryAccepted' }
+        '400': { $ref: '#/components/responses/BadRequest' }
+        '403': { $ref: '#/components/responses/Forbidden' }
+        '409': { $ref: '#/components/responses/Conflict' }
+        '413': { $ref: '#/components/responses/PayloadTooLarge' }
   /api/state:
     get:
       summary: Get a complete role-safe state snapshot
@@ -175,6 +205,11 @@ components:
       schema: { $ref: '#/components/schemas/Token' }
       description: Omit only when a spectator-safe public view is intended.
   responses:
+    RecoveryAccepted:
+      description: Recovery completed or an idempotent retry observed the same completed recovery.
+      content:
+        application/json:
+          schema: { $ref: '#/components/schemas/RecoveryAccepted' }
     CommandAccepted:
       description: Command accepted by the authoritative application layer.
       content:
@@ -269,6 +304,13 @@ components:
         - type: object
           required: [role]
           properties: { role: { $ref: '#/components/schemas/Role' } }
+    RecoveryAccepted:
+      type: object
+      required: [ok, resetReason, generation]
+      properties:
+        ok: { type: boolean, enum: [true] }
+        resetReason: { type: string, enum: [session_left, profile_reset, game_reset] }
+        generation: { $ref: '#/components/schemas/GameId' }
     Info:
       type: object
       required: [ok, phase, gameId, version, player1Available, player2Available, player1Name, player2Name, spectatorsAvailable]