OSRS account types (game modes) on players

[yonnski]

Summary

Adds an optional account_type field (OSRS game mode from RuneLite varbit 1777) that flows from intake submissions to the player row to the Web API v1 profile payload. The frontend (droptracker-web PR #18) is already built against this contract and tolerates the field being absent.

• Intake: apply_account_type() in data/submissions/common.py validates the wire string against the seven-mode enum and stores it last-write-wins (a de-ironed account downgrades to normal on its next submission). Invalid or absent values are ignored and can never fail a submission. Each of the eight processors calls it in one added line after the auth check, so spoofed submissions can't flip a player's mode. Covers direct intake, queue mode, the legacy webhook bot, and manual submissions.
• Seasonal guard (judgment call): League/seasonal-world submissions never write account_type — a league account's varbit says nothing about the main account's mode. One-line gate to remove if undesired.
• Storage: nullable Player.account_type (String(32)). Migration web91a_player_account_type is authored but not in this PR — alembic/versions/ is gitignored per repo convention. Deploy step: create it on the deploy box (adds players.account_type VARCHAR(32) NULL) with down_revision pointed at the current alembic heads (web90a_site_page_css at authoring time). No backfill; populates organically.
• Web API v1: GET /api/v1/players/{id} returns account_type when set, omits it when never reported.
• OpenAPI: PlayerProfile gains the optional account_type enum property, matching the web repo's AccountTypeSchema.

Test plan

• python -m pytest tests/unit/ -q — 4276 passed, 2 skipped, including 11 new tests in tests/unit/test_account_types.py (written TDD-first): helper validation/normalization, last-write-wins de-iron overwrite, invalid/absent/seasonal ignored, never-raises, profile route returning vs. omitting the field, OpenAPI enum pinned to the spec's seven values. (One unrelated pre-existing failure locally: test_submission_received_at.py::test_tz_aware_stamps_are_converted_not_rejected fails identically on a clean new-api checkout on this machine — timezone-dependent assertion.)
• Author + run the web91a_player_account_type migration on the deploy box.
• Web repo re-vendors openapi.json + pnpm gen:api-types; coordinate the RuneLite plugin release that sends the field.

🤖 Generated with Claude Code