getNetworkKey

Resolves the network key that links this backend with its proxy. The proxy owns the key; a backend either already has it, seeds it once, or is given it.

1. getNetworkKey — persisted from a previous boot or from provisioning. The steady state.
2. A one-time seed from plugins/floodgate/key.pem, when this backend happens to run Floodgate. Keeps networks that already work on the identity they already use.
3. Nothing — return null and say so. The proxy grants a key on the first player join.

Earlier versions derived from key.pem first and, failing that, generated a random UUID silently. That was built on the false premise that Floodgate needs its key on every backend; it does not, so on the topology Floodgate itself documents — Floodgate on the proxy only — every backend invented a key that could never match the proxy, and nothing reported it.