feat(kit): the two shapes Teams added, taught and built

MODULE_API 1.6.0 expands the contract this book teaches against, so the book
owes two shapes and one correction. Chapter 2 gains both and the template grows
a working version of each, because a reader following a snippet has no way to
find out whether it runs.

ONE SENTENCE WAS WRONG. Chapter 2 said, of extension slots, "Only core may
declare a slot; a module may only fill one". 1.6.0 inverted exactly that: a
module declares a place on its OWN page and core fills it. That is not a stale
detail - a new game's module cannot implement Teams at all without the inverted
direction, so it is the shape the reader needs and did not have.

THE TWO SHAPES

- The inverted slot. A new "Slots go the other way too" section: why the
  direction has to invert (core owns the Team, not the word for one), the
  namespace rule, one slot per PLACE, the optional { core } naming which of
  core's three contributions goes there, and why asking for one core does not
  offer throws when almost everything else in that registry fails open.

- registerTeamProvider, in "Becoming the source of Teams". The first
  registration where core calls YOU and waits, which is where every rule in it
  comes from: the envelope, the ten-second budget, refusing as a normal answer,
  and the one mistake worth naming - answering with an empty list because the
  game is unreachable, which core reads as authoritative and acts on.
  projectRoster gets its own treatment because it is the exception that fails
  CLOSED. pageUrlTemplate is a footnote beside it, as intended.

WHAT THE TEMPLATE GREW

model/clans/ - the provider over two tables, with the guards that matter: an
unreachable game refuses rather than reporting no clans, an empty roster is
refused unless the game says the clan is empty (which is why the schema keeps a
member count the rows cannot supply), and the audience rule lives in one file
that both projectRoster and the module's own page consult, because a second copy
drifts in the direction that publishes what core is withholding.

Its own /clans routes, deliberately not /teams - core mounts that itself, and
the loader would refuse the collision. A clan list page and a clan page that
declares three slots for core.

12 provider tests and three registration tests, 47 server and 20 client in
total. The purge test finally proves something: two of the three tables are now
a parent and its child.

WHAT IT DOES NOT DO. Enumerate the contract. The kit teaches one path end to end
and links out; it has never mentioned three pre-Teams registrations and that is
the design, not a gap.

FOUND WHILE WRITING IT: core filled three literal uo.guild.* slot names, so the
inverted direction reached exactly one module and every other game's page came
up empty with nothing logged. Fixed in website#160 / Module-uo#15 / docs#165
before this chapter could teach it - which is what this phase is for.

The ci/core-ref.json pin moves in a later commit on this branch: checkCoreApi is
an equality against a core on main, and 1.6.0 does not reach main until the
cutover.

Co-Authored-By: Claude <noreply@anthropic.com>

template/README.md

@@ -5,11 +5,16 @@ rename it, and you have a running module before you have read a chapter.
 
 Installed into a core, it adds:
 
-- **one public page** at `/examplegame/status`, and a nav row pointing at it;
-- **one API route**, `GET /api/v1/public/world/status`, described in an OpenAPI
-  fragment core merges into its own `/api/docs`;
-- **one table**, `examplegame_world_status`, created by an idempotent schema
+- **three public pages** — `/examplegame/status`, `/examplegame/clans` and one
+  clan at `/examplegame/clans/:externalId` — and nav rows pointing at the first two;
+- **three API routes** under `/api/v1/public/world` and `/api/v1/public/clans`,
+  described in an OpenAPI fragment core merges into its own `/api/docs`;
+- **three tables**, prefixed `examplegame_`, created by an idempotent schema
   fragment and dropped by a purge file;
+- **a Team provider**, which makes this module the authoritative source of Teams
+  for the deployment — the one registration where core calls YOU and waits;
+- **three inverted extension slots**, declared by this module on the clan page for
+  core to fill;
 - **both lifecycle hooks**, so there is something to see at boot and at shutdown.
 
 That is deliberately less than your module will do. What it is *complete* about is
@@ -27,17 +32,18 @@ server/
   db/schema.sql             idempotent, replayed every boot
   db/purge.sql              destructive, run only by an explicit admin purge
   model/worldStatus/        the .db.js / .model.js pair
-  router/public/            one router, one controller, the #swagger annotations
+  model/clans/              the Team provider, its SQL, and the audience rule
+  router/public/            two routers, two controllers, the #swagger annotations
   swagger/doc.js            tags and schemas the annotations refer to
   scripts/checkImports.js   the module boundary, enforced
   scripts/swaggerFragment.js  generates swagger-fragment.json from your own routes
   test/                     the suites — start with entry.test.js
 client/
   vite.config.js            the library build: anchored aliases, external: []
-  src/entry.jsx             registers routes and nav at evaluation time
-  src/core.js               what core hands you: the UI kit (eight exports)
+  src/entry.jsx             registers routes, nav and declared slots at evaluation time
+  src/core.js               what core hands you: the UI kit (nine exports)
   src/shim/                 the four shared dependencies, re-exported from core
-  src/routes/public/        the page
+  src/routes/public/        the pages — Clan.jsx is the one with slots in it
   scripts/checkExternals.js asks the BUILT chunk whether a bare import survived
   test/                     build.test.js and registration.test.js
 .gitea/workflows/release.yml   packaging CI — Gitea
@@ -110,17 +116,23 @@ backticking table names**.
 | `server/db/schema.sql` | every table name — the prefix must be your id |
 | `server/db/purge.sql` | the same table names |
 | `server/model/worldStatus/worldStatus.db.js` | the `TABLE` constant |
+| `server/model/clans/clanProvider.db.js` | the `CLANS` and `MEMBERS` table constants |
+| `server/model/clans/clanProvider.model.js` | `pageUrlTemplate` — it must match the route `client/src/entry.jsx` registers |
 | `server/router/public/world.router.js` | the `#swagger.tags` name |
+| `server/router/public/clans.router.js` | the `#swagger.tags` name |
 | `server/swagger/doc.js` | the tag, and the `Examplegame…` schema prefix |
 | `server/scripts/swaggerFragment.js` | the generated fragment's `info.title` |
 | `server/test/_fakes.js` | `ctx.moduleId` |
 | `server/test/worldStatus.test.js` | the fixture's world name |
+| `server/test/clanProvider.test.js` | the fixture's world name |
 | `server/package-lock.json` | **regenerated** — `npm install --prefix server` |
 | `client/package.json` | package `name` and `description` |
 | `client/vite.config.js` | the guard plugin's `name` |
 | `client/src/core.js` | the console tag on the identity check |
 | `client/src/shim/rg.js` | the console tag on the missing-global error |
-| `client/src/entry.jsx` | `ID`, and every route path and nav `to` |
+| `client/src/entry.jsx` | `ID`, every route path and nav `to`, and the three `declareModuleSlot` names — core enforces that a slot is namespaced under your id |
+| `client/src/routes/public/Clans.jsx` | the link to the clan page |
+| `client/src/routes/public/Clan.jsx` | the three `<Slot name>` values and their `moduleId` |
 | `client/test/registration.test.js` | the example path in the comment |
 | `client/package-lock.json` | **regenerated** — `npm install --prefix client` |
 | `swagger-fragment.json` | **regenerated** — `npm run swagger --prefix server` |
@@ -133,11 +145,14 @@ placeholder and is not listed fails the build, and so does a listed file with
 nothing left to rename. A checklist nobody verifies is a checklist that is wrong
 by the second edit.
 
-Two things you do **not** rename: the mount prefix `/world` need not be your id
-(the server's prefix namespace is shared with core's, and `/status`, `/settings`,
-`/version` and `/contact` are already taken), and the `world` / `worldStatus`
+Two things you do **not** rename: the mount prefixes `/world` and `/clans` need
+not be your id (the server's prefix namespace is shared with core's — `/status`,
+`/settings`, `/version`, `/contact` and `/teams` are already taken, which is why
+the clan router is not mounted at the obvious name), and the `world` / `clan`
 naming throughout is ordinary vocabulary you should replace with your own domain's
-when you replace the feature.
+when you replace the feature. **`clan` in particular is the point rather than the
+placeholder:** core's word is Team, yours is whatever your game says, and the
+provider exists because core cannot pick one.
 
 ## Licence