feat: mint matchId and turnToken in PostStartMatch

src/Http/Handlers/PostStartMatch.php

@@ -6,6 +6,7 @@ namespace BattleForge\Http\Handlers;
 
 use BattleForge\Application\ScenarioDraft;
 use BattleForge\Application\ScenarioSerializer;
+use BattleForge\Application\TurnToken;
 use BattleForge\Domain\ScenarioValidator;
 use BattleForge\Http\CsrfToken;
 use BattleForge\Http\Request;
@@ -36,6 +37,20 @@ final class PostStartMatch
             return Response::json(400, ['errors' => [$exception->getMessage()]]);
         }
 
-        return Response::json(200, ['match' => ScenarioSerializer::matchToArray($match)]);
+        $matchId = bin2hex(random_bytes(8));
+        $matchArray = ScenarioSerializer::matchToArray($match);
+        $turnToken = TurnToken::issue(
+            $secret,
+            $matchId,
+            $match->activeTeamId,
+            $match->round,
+            count($match->actionLog),
+        );
+
+        return Response::json(200, [
+            'match' => $matchArray,
+            'matchId' => $matchId,
+            'turnToken' => $turnToken,
+        ]);
     }
 }