feat(rust): slash commands and the next wipe, server half (phase 16)

Five read-only commands registered with api.registerSlashCommands:
/status, /wipe, /top, /online and /clan (D126). Every refusal is private,
and any answer narrower than public (online names, a clan roster) goes
to the caller alone (D127). No command asks a sidecar.

The next wipe (D128, D130): six nullable columns on rust_servers, a pure
nextWipe(row, now) with the zone arithmetic through Intl, computed on
every read. The public server shape gains nextWipe; the admin shape
gains the stored schedule; PUT /admin/rust/servers/:id takes the six
fields and writes them only when wipeRule is present.

server/commands joins ci/bundle.json, which checkBundle caught.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/index.js

@@ -60,6 +60,7 @@ module.exports = function register(ctx, api) {
   const eventWorld = require('./eventWorld')
   const eventRewards = require('./eventRewards')
   const boot = require('./boot')
+  const commands = require('./commands')
   /* eslint-enable global-require */
 
   const log = core.logger()
@@ -183,11 +184,12 @@ module.exports = function register(ctx, api) {
     ...eventRewards.OPTION_SOURCES,
   ])
 
-  // Everything else this module will register — the slash commands — is
-  // deliberately absent, and arrives with the phase that has something real to
-  // put in it. A registration with nothing behind it is worse than a missing
-  // one: a declared trigger nothing emits and a declared slot nothing fills are
-  // both surfaces an operator can configure and then wait on.
+  // The slash commands (phase 16, R11). The handlers run HERE, in the website
+  // process; the bot pulls the definitions and dispatches each call back. Every
+  // command is `access: 'everyone'` and resolves its own audience gate inside the
+  // handler, and every answer narrower than public is sent to the caller alone
+  // (D127) — see `commands/common.js`.
+  api.registerSlashCommands(commands)
 
   log.info('registered', {
     version: require('../module.json').version,
@@ -201,6 +203,7 @@ module.exports = function register(ctx, api) {
     actions: eventWorld.ACTIONS.length + eventRewards.ACTIONS.length,
     budgets: eventWorld.BUDGETS.length + eventRewards.BUDGETS.length,
     announceLeg: eventRewards.LEG.leg,
+    commands: commands.map((cmd) => cmd.name).join(' '),
     optionSources: eventLeases.OPTION_SOURCES.length + eventWorld.OPTION_SOURCES.length + eventRewards.OPTION_SOURCES.length,
   })
 }