bf783639c1
The translation middleware decrypts + msgpack-decodes the request body into the action's first-parameter type, then re-serializes that DTO to JSON for the auth handler to read. Phase 3's DoMatchingRequestDto and RankBattleFinishRequestDto didn't inherit BaseRequest, so viewer_id / steam_id / steam_session_ticket were dropped during the msgpack → DTO → JSON pivot — the auth handler then saw a body with no auth fields and 401'd every request. Fixed by making both DTOs extend BaseRequest, mirroring the Phase 2 TK2 DoMatchingRequest pattern. Also added [FromBody] BaseRequest parameters to the previously body-less actions (AiStart × 2, ForceFinish, AddClientLog, GetLatestMasterPoint). The translation middleware explicitly requires at least one parameter to bind the decrypted msgpack body (see L130-136 of the middleware); without it the request would throw InvalidOperationException at runtime. Tests updated to post viewer_id / steam_id / steam_session_ticket placeholder values in the request body, matching the existing TK2 test pattern. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>