Fix join state checks for server switches

[frederickbaier]

Description

Players who were already connected to the proxy could be blocked while switching servers because the proxy-level join-state check ran for every server connect event, not only for the initial proxy join. That made maintenance/full-network checks apply again during normal server switches before the target server join-state check ran. Server names with hyphenated group names such as cave-ffa-1 also failed the join-state service parser, so target service join states could be missed and fall back incorrectly.

Changes

• Limit Velocity proxy join checks to the initial connection by checking previousServer == null.
• Limit BungeeCord proxy join checks to initial proxy joins using JOIN_PROXY or a missing current server.
• Keep target server join-state checks active for server switches.
• Allow join-state service parsing for group names containing letters, digits, underscores, and hyphens, so cave-ffa-1 resolves to group cave-ffa and numerical id 1.
• Include the resolved join state and required permission in the Velocity denial log for easier diagnosis.

Type of Change

• New feature / capability
• Bug fix
• Refactoring
• Documentation
• Infrastructure / CI/CD

Behavior Change

Before:
Proxy-level join-state and full-network checks ran again during server switches, and hyphenated service names like cave-ffa-1 did not parse as <group>-<id>.

After:
Proxy-level join-state checks run only on initial proxy join, target server join-state checks still run on switches, and cave-ffa-1 resolves to the cave-ffa service with numerical id 1.

Pre-Deployment Migrations

No migrations required before deploying.