feature: refuse players who are not on a restricted server's access list

[lukepolo]

The Player Management plugin now enforces a community server's access list from the panel, refusing players at connect and removing anyone the list no longer allows.

• Sync response access block (restricted, version, denied); the full list is fetched from GET /sanctions/server/:id/access only when the version changes, and the last list stays in force if the panel is down
• ConnectClient hook (both runtimes, same signature as the practice plugins): denied players get a blanked ticket, allowed players skip sv_password; open servers are untouched
• Players the sync reports as denied are kicked once with a translated message (all locales)
• player_management_status shows the access state