Harden and feature-flag the Friend System rollout

[coder13]

Goal

Ship the Friend System without turning user search, friend requests, notifications, or room invitations into new abuse, privacy, or operational failure modes.

Security and privacy requirements

• Deny social reads/actions by default unless the authenticated relationship and resource state allow them.
• Enforce authorization server-side on every HTTP and Socket.IO action.
• Apply an explicit HTTP/Socket origin allowlist instead of reflecting arbitrary origins.
• Validate and size-limit social payloads and add per-user/per-pair rate limits for search, requests, blocks, notification actions, and invitations.
• A block must prevent new friend requests and invites, revoke pending social actions, and avoid revealing to the blocked user that a block exists.
• Never request, retain, search, log, analyze, or deliver through email; Stop requesting, storing, and mirroring WCA email addresses #191 is a hard launch prerequisite.
• Never log names, WCA IDs, access tokens, room passwords, notification contents, or friend graph edges.
• Do not expose online presence, hidden WCA identity, or private-room metadata outside the intended audience.

Rollout and observability

• Gate server behavior and client entry points behind one documented SOCIAL_FEATURES_ENABLED rollout switch.
• Ensure the disabled state leaves existing room/timer behavior unchanged and provides a tested rollback path.
• Add privacy-safe metrics for request creation/acceptance, invite creation/join conversion, notification delivery/reconciliation failures, authorization failures, and rate-limit triggers.
• Add indexes/retention jobs before enabling writes and expose health/degraded signals for required social persistence paths.
• Test old-client/new-server and new-client/old-server behavior for the adjacent release window.
• Add abuse/authorization tests for ID tampering, blocked pairs, duplicate/replayed actions, unauthenticated access, disallowed origins, oversized payloads, rate limits, and email-like discovery input.
• Document data retention, account deletion behavior, incident rollback, and a short production verification checklist.
• Enable for a small test cohort/staging first, verify metrics and two-user flows, then enable broadly.

Launch dependencies

• Stop requesting, storing, and mirroring WCA email addresses #191 stop requesting and purge WCA email
• Normalize usernames for safe, indexed user lookup #185 normalized username foundation
• Build the friend request, friendship, and blocking lifecycle #75 friendship lifecycle and blocking
• Add privacy-safe cuber discovery and public profiles #82 discovery/public profiles
• Add a typed in-app notification inbox for social actions #105 notification inbox
• Add a friends hub with realtime online presence #186 friends hub/presence
• Let friends invite each other into active rooms #187 room invitations
• Complete the modernized production rollout in Rehearse and execute the modernized production rollout with a tested rollback #176

Non-goals

• Direct messages (Add direct messages between friends after the social MVP #189).
• Browser push.
• Opt-in stranger matching (Add opt-in racer preferences and discovery filters #190).