feat(lobby): use native WebSocket, drop faf-ws-bridge

faf-python-server now speaks WebSocket directly on 8003/ws, so the
ws_bridge_rs sidecar is no longer needed.

- Point the IngressRoute for ws.{baseDomain} at faf-lobby-server:8003
  instead of faf-ws-bridge:8003 (and rename the resource).
- Remove the LISTEN block from the lobby config; the new server reads
  WS_HOST/WS_PORT/WS_PATH and the defaults already produce :8003/ws.
- Set WS_FORWARDED_IP_HEADER=CF-Connecting-IP so the real client IP
  from Cloudflare is preserved.
- Bump image to faforever/faf-python-server:feature-websocket for the
  test deploy.
- Delete apps/faf-ws-bridge entirely.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Brutus5000

apps/faf-lobby-server/config/config.yaml

@@ -1,11 +1,10 @@
 CONFIGURATION_REFRESH_TIME: 60
 LOG_LEVEL: "INFO"
 
-LISTEN:
-  - ADDRESS:
-    PORT: 8003
-    PROTOCOL: SimpleJsonProtocol
-    PROXY: true
+# The server speaks WebSocket natively on 8003/ws (the defaults). Traefik
+# terminates TLS and forwards directly to this pod, so trust the
+# CF-Connecting-IP header that Cloudflare sets to get the real client IP.
+WS_FORWARDED_IP_HEADER: "CF-Connecting-IP"
 
 DB_SERVER: "mariadb"
 DB_LOGIN: "faf-python-server"

apps/faf-lobby-server/templates/deployment.yaml

@@ -21,7 +21,7 @@ spec:
     spec:
       terminationGracePeriodSeconds: 3600
       containers:
-        - image: faforever/faf-python-server:v1.17.0
+        - image: faforever/faf-python-server:feature-websocket
           imagePullPolicy: Always
           name: faf-lobby-server
           envFrom:

apps/faf-ws-bridge/templates/ingress.yaml …/faf-lobby-server/templates/ingress.yamlapps/faf-ws-bridge/templates/ingress.yaml renamed to apps/faf-lobby-server/templates/ingress.yaml apps/faf-ws-bridge/templates/ingress.yaml renamed to apps/faf-lobby-server/templates/ingress.yaml

@@ -1,13 +1,13 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: faf-ws-bridge
+  name: faf-lobby-server
 spec:
   entryPoints:
     - websecure
   routes:
     - match: Host(`ws.{{.Values.baseDomain}}`)
       kind: Rule
       services:
-        - name: faf-ws-bridge
+        - name: faf-lobby-server
           port: 8003