You should avoid iterating the list of permitted accounts. It's an expensive approach that doesn't scale and it has a lot of moving parts.
Consider instead using a mapping. This is a namespace where all the uninitialized indexes return false, 0, empty, depending on type. For example:
mapping(address => bool) public whitelist; returns true or false for ...
All your migrations run from the beginning.
Using ganache blockchain (for this example), you can check this information at the bottom of your contract's .json files.
I recommend that you look at the OpenZeppelin guide on Access Control, specifically the section on Role-Based Access Control as using Roles from OpenZeppelin appear to meet your needs.
For questions on use, you can also ask in the community forum https://forum.zeppelin.solutions/
You are making a fundamental mistake which makes it all seem much harder than it really is.
Instead of an array, your should use a mapping(address => bool), let's call it whitelisted.
Add people in the whitelist like this: whitelisted[_address] = true;
then in your modifier, you can simply do this:
I assume that you are connecting your DApp with the blockchain using the browser web3 instance, which is provided by metamask. The alternative is to use Infure or your own node and change the web3 provider, then metamask will not pop-up and you can implement your own logic when someone click on a button to send a transaction, but then it is more complicated.
Your question is too broad, because Ethereum is a smart contract platform and payments can be handled by contracts.
If you just want to learn ethereum development I would advice to checkout cryptozombies to get started into coding in a fun way.
Both players should keep their own copy of the latest state. The server could be a backup, and although it would be a centralized back up, the server will not be able to tamper with the state if players control their secret private keys.
https://medium.com/@graycoding/lessons-learned-from-making-a-chess-game-for-ethereum-6917c01178b6 and its code may also ...
Metamask is a browser extension. More info: https://metamask.io
It is not used in node.js or server side implementation. For server side, you have to unlock accounts using private keys, etc.
Sample code for browser side ...