No, we haven't done much to secure the online playing experience for strangers other than simply enforcing the rules of the game. We've been so far more focused on the API side of building game than the service side of having customers, but these are all on our radar as table stakes to make this an nice experience for random players.
Thanks for the comment, and yes we'd love to add more docs. (it's time consuming!) I understand that even a simple-sounding game can feel daunting to translate into a formalized API. I did record a video of me building part of a game FWIW.
We've been planning to add a way to do pluggable AI functions (both for solitaire play and for testing). If you want to try, take a look at the TestRunner class for an easy way to automate playing the rules for multiple players.
I thought AGPL was ok as well, but Commons Clause specifically tried to address perceived deficiencies in the AGPL although I admit that it didn't really seem to catch on. I'm not super well versed in the technical details. Why would you recommend AGPL?