Harden recruit lifecycle authority

[kaiserproger]

Summary

• Harden hire, disband, promote, recruit GUI, scout, and patrol-leader packets with server-side ownership/session checks.
• Make noble-villager hiring use server-side trade/session/villager validation and authoritative trade cost before consuming uses.
• Preserve existing command/action authority helpers while rejecting malformed enum/payment inputs.

Verification

• source "$HOME/.sdkman/bin/sdkman-init.sh" && ./gradlew compileJava
• code-simplifier pass completed
• code-reviewer pass completed with no findings