fix(auth): grant GameLauncher sessions ServerListReadOnly access

[undead2146]

Summary

SessionHelpers.SessionTypeHasAccessTo only grants GameClient and ignores the requested access type, so every GameLauncher caller of GET /Lobbies falls into the explicit 500 branch in LobbiesController.Get — even though the AnyClientOrMonitorOrApiKey policy admits the GameLauncher role. Launcher clients (client_id: genhub, which maps to GameLauncher in KnownClientSessionTypes) can sign in but can never list lobbies.

Changes

• GenOnlineService/Constants.cs: grant GameLauncher the ServerListReadOnly access the enum documents ("can read lobby list and players etc, but cannot join"). All other access types stay GameClient-only.

Blast radius

ServerListReadOnly is consumed only by LobbiesController.Get. Verified every other SessionTypeHasAccessTo caller passes Gameplay or Authenticate, so no join, mutate, matchmaking, social, or gameplay path is affected by this change.

Notes

• Observed against production: GET /Lobbies with a valid genhub session returns 500; the only 500 path in that handler is the access-denied branch (exceptions are caught and return 200 with an empty result).
• Out of scope but worth a look: the access-denied branch sets InternalServerError; 403 Forbidden would let clients distinguish denial from a real server error.
• Could not build locally (repo targets .NET 10, only the .NET 8 SDK is available here); relying on CI.