GroupVerify 0.2.0: Steam group / override verification with an API for other plugins

Players are verified when they're in the configured Steam group (public memberslistxml,
refetched every 10 minutes, kept on failure) or have an unexpired override row in
gv_verified, written by the web panel. Settings and data live in CS2-SimpleAdmin's MySQL
database (gv_verified, gv_settings, gv_migrations), reached through its API.

- css_gv_group <groupId64|0>, css_gv_enable, css_gv_disable (@css/root): verification runs
  only when enabled with a group set.
- css_verify <target>: why a player is or isn't verified. Admin and above (by immunity from
  SimpleAdmin's groups) plus Guardian, unless admin_overrides.json says otherwise.
- groupverify:api (shared/GroupVerifyApi): IsVerified, GetStatus, IsActive and
  OnVerifiedChanged. The API object lives in the shared assembly, so it survives hot
  reloads of GroupVerify.

GroupVerifyApi/IGroupVerifyApi.cs

@@ -0,0 +1,56 @@
+using CounterStrikeSharp.API.Core;
+using CounterStrikeSharp.API.Core.Capabilities;
+
+namespace GroupVerifyApi;
+
+/// <summary>
+/// Whether players are verified by GroupVerify: in the configured Steam group, or given a manual
+/// override on the web panel. Get it in <c>OnAllPluginsLoaded</c> with
+/// <c>IGroupVerifyApi.Capability.Get()</c>. Use it on the game thread only.
+/// </summary>
+/// <remarks>
+/// The object stays valid when GroupVerify is hot-reloaded, and event subscriptions stay attached.
+/// While GroupVerify is unloaded, disabled or has no group set, <see cref="IsActive"/> is false and
+/// nobody is verified.
+/// </remarks>
+public interface IGroupVerifyApi
+{
+    /// <summary>The capability GroupVerify registers.</summary>
+    public static readonly PluginCapability<IGroupVerifyApi> Capability = new("groupverify:api");
+
+    /// <summary>
+    /// True when GroupVerify is loaded, enabled, has a Steam group set and has read its database.
+    /// When false, every check returns not verified.
+    /// </summary>
+    bool IsActive { get; }
+
+    /// <summary>
+    /// Whether the player is verified. False for bots and players Steam hasn't authorized yet.
+    /// </summary>
+    bool IsVerified(CCSPlayerController player);
+
+    /// <summary>Whether a SteamID64 is verified, online or not.</summary>
+    bool IsVerified(ulong steamId64);
+
+    /// <summary>Why a SteamID64 is or isn't verified, online or not.</summary>
+    VerifyStatus GetStatus(ulong steamId64);
+
+    /// <summary>
+    /// Fired on the game thread when an online player's verified status changes: true when they
+    /// become verified (including right after connecting), false when they stop being verified
+    /// (they left the group, their override ran out, or GroupVerify was disabled). Not fired on
+    /// disconnect. After GroupVerify is hot-reloaded it fires true again for everyone verified,
+    /// so handlers should be idempotent.
+    /// </summary>
+    event Action<CCSPlayerController, VerifyStatus>? OnVerifiedChanged;
+}
+
+/// <summary>A player's verification, and why.</summary>
+/// <param name="InGroup">In the Steam group's member list.</param>
+/// <param name="HasOverride">Has an unexpired manual override.</param>
+/// <param name="OverrideExpires">When the override ends, in GroupVerify's database time zone; null if it never does (or there's none).</param>
+public readonly record struct VerifyStatus(bool InGroup, bool HasOverride, DateTime? OverrideExpires)
+{
+    /// <summary>In the group, or has an override.</summary>
+    public bool Verified => InGroup || HasOverride;
+}