feat(capture): replay bundles against a sandbox stack with a headless client

CaptureTool (built next to the servers) replays packet bundles and compares the answers:

- replay: per bundle a fresh sandbox folder with copied server binaries, rewritten settings
  (replay_sandbox=1, a new SQLite file inside the folder, ports from --port on, no dashboard),
  read back before anything starts; sandbox-setup runs inside it to apply migrations and make
  the replay account and the bundle's characters (setup mode); master is started, the stack is
  stopped as one process group and the folder deleted unless kept
- with replay_sandbox=1 every server refuses a database that isn't SQLite, isn't inside its
  own folder, or is replay_live_sqlite_path (Database::Connect); replay-target against a
  running server needs --i-know-this-is-not-a-sandbox
- the fake client splits the recording into connections, logs in and picks the character
  itself when the recording doesn't, fills in the target's account, session key and IDs,
  learns server-made object IDs from replica constructions by LOT, follows the recorded
  timing and waits for the answers a client waits for; the diff pairs answers by name (and
  constructions by LOT) and ignores fields that differ between runs
- import-live converts the 2014 live captures (folders of *_traffic.zip; pcaps and encrypted
  captures are left alone) into bundles, with secrets removed and CREATE_CHARACTER as setup
- anonymise makes local fixtures; docs/CaptureReplay.md describes capture, the bundle format,
  portability rules, the sandbox and the replay

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dDatabase/GameDatabase/Database.cpp

@@ -7,12 +7,37 @@
 #include "SQLiteDatabase.h"
 #include "MySQLDatabase.h"
 
+#include <filesystem>
 #include <ranges>
+#include <stdexcept>
+
+#include "BinaryPathFinder.h"
 
 #pragma warning (disable:4251) //Disables SQL warnings
 
 namespace {
 	GameDatabase* database = nullptr;
+
+	/**
+	 * A replay sandbox (replay_sandbox=1, docs/CaptureReplay.md) only ever uses its own SQLite file, inside its own
+	 * folder, and never the live one: anything else and the server refuses to start.
+	 */
+	void CheckSandbox(const std::string& databaseType) {
+		if (!Game::config || Game::config->GetValue("replay_sandbox") != "1") return;
+		if (databaseType != "sqlite") throw std::runtime_error("A replay sandbox only runs on its own SQLite database (database_type=sqlite)");
+		namespace fs = std::filesystem;
+		const auto folder = fs::weakly_canonical(BinaryPathFinder::GetBinaryDir());
+		const auto path = fs::weakly_canonical(folder / Game::config->GetValue("sqlite_database_path"));
+		const auto relative = path.lexically_relative(folder);
+		if (Game::config->GetValue("sqlite_database_path").empty() || relative.empty() || *relative.begin() == "..") {
+			throw std::runtime_error("A replay sandbox's database must be inside its own folder (" + folder.string() + "), not " + path.string());
+		}
+		const auto live = Game::config->GetValue("replay_live_sqlite_path");
+		std::error_code ec;
+		if (!live.empty() && fs::exists(live, ec) && fs::equivalent(path, live, ec)) {
+			throw std::runtime_error("A replay sandbox must not use the live database " + live);
+		}
+	}
 }
 
 std::string Database::GetMigrationFolder() {
@@ -34,6 +59,7 @@ void Database::Connect() {
 	}
 
 	const auto databaseType = GetMigrationFolder();
+	CheckSandbox(databaseType);
 
 	if (databaseType == "sqlite") database = new SQLiteDatabase();
 	else if (databaseType == "mysql") database = new MySQLDatabase();
@@ -55,6 +81,7 @@ GameDatabase* Database::Get() {
 
 std::unique_ptr<GameDatabase> Database::CreateConnection() {
 	std::unique_ptr<GameDatabase> connection;
+	CheckSandbox(GetMigrationFolder());
 	if (GetMigrationFolder() == "sqlite") connection = std::make_unique<SQLiteDatabase>();
 	else connection = std::make_unique<MySQLDatabase>();
 	connection->Connect();