feat(rust): the live map (phase 14, protocol 11)

PLAN.md §30 as approved, plus D119/D120 from the build.

Server:
- rust_map_images (one row per server: picture as MEDIUMBLOB, geometry,
  monuments, DERIVATION_VERSION) and rust_map_overrides; purge.sql pair.
- mapImages.js: D110. The board poll notices a new boot/wipe/seed/size and
  asks map.info; a new key or hash from the free Rust+ cache (or a render
  kept on disk) is fetched in slices, checked against its SHA-256 and stored
  in one statement. One fetch per server, a backoff on failure, `stale`
  abandons a fetch that straddles a map change. Render now (D109) is
  admin-only and watched to completion.
- mapLive.js: D111. One map.live per server per 5 s whoever asks; positions
  are held in memory only.
- model/map: four layers (world, events public; players, bases staff), a
  fleet default plus per-server override (D114), the players layer capped by
  presence (D113), own dot and online first-party clan mates for a linked
  viewer (D115, D117, D118). A layer the viewer may not see is absent from
  the answer, never sent and hidden.
- Routes: public /servers/:id/map, /map/image (immutable under its hash),
  /map/live; admin /servers/:id/map/fetch and /render; the Map card on the
  visibility PUT. Swagger fragment and frozen manifest regenerated.

Client:
- A Map tab: Leaflet over the picture in CRS.Simple, the game's own grid
  (labels only when a cell is wide enough to hold one), a legend that lists
  hidden layers with who can see them, polled every 10 s while visible.
- D120: Leaflet is a lazy split chunk beside entry.js, not in it. release.yml
  copies every dist/*.js; checkExternals and build.test.js hold both ends.
- The Map card on Admin -> Rust visibility, with Fetch again and Render now.

Capability `map` declared for the Android app (phase 15).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

client/scripts/checkExternals.js

@@ -82,9 +82,10 @@ export function stringMask(src) {
   return inString
 }
 
-// Static and dynamic imports that survived into the output. A relative or
-// absolute specifier is a chunk that was split, which this build does not do —
-// `lib` mode with one entry emits one file — so anything here is a bare name.
+// Static and dynamic imports that survived into the output. A relative
+// specifier is a chunk that was split — since D120 there is one, Leaflet's,
+// which the Map tab imports with `import()` — and is `relativeImports`'s
+// concern below; a bare name is this check's.
 //
 // **This pattern used to require whitespace after `import`, and so could not see
 // the one shape the build actually emits.** Minified Rollup output is
@@ -116,6 +117,28 @@ export function bareImports(chunk) {
   return [...bare]
 }
 
+/**
+ * Every relative specifier the chunk imports — its split chunks (D120).
+ *
+ * Each one is a file the browser will ask for beside `entry.js`, and core
+ * serves that directory, so it works in development. Whether it SHIPS is
+ * `release.yml`'s business, which is why the script below also asserts every
+ * one of them exists in `dist/`, and `test/build.test.js` asserts the release
+ * copies every `.js` in `dist/` rather than naming `entry.js`. A split chunk the
+ * release forgot is a Map tab that spins for ever on an operator's site while
+ * every check here passes.
+ */
+export function relativeImports(chunk) {
+  const masked = stringMask(chunk)
+  const found = new Set()
+  for (const match of chunk.matchAll(IMPORTS)) {
+    const keywordAt = match.index + (match[0].startsWith('import') ? 0 : 1)
+    if (masked[keywordAt]) continue
+    if (match[1].startsWith('./')) found.add(match[1].slice(2))
+  }
+  return [...found]
+}
+
 // Fingerprints from the shared libraries' own source. Each is a string those
 // packages ship and this module has no other reason to contain.
 //
@@ -161,12 +184,30 @@ if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.me
     console.error(`No chunk at ${CHUNK} — run \`npm run build\` first.`)
     process.exit(1)
   }
-  const problems = problemsWith(fs.readFileSync(CHUNK, 'utf8'))
+  const dist = path.dirname(CHUNK)
+  const entry = fs.readFileSync(CHUNK, 'utf8')
+  const problems = []
+
+  // Every chunk, not only the entry: a split chunk that bundled a second React
+  // would load on the tab that imports it and fail there, and nowhere else.
+  for (const file of fs.readdirSync(dist).filter((f) => f.endsWith('.js'))) {
+    for (const p of problemsWith(fs.readFileSync(path.join(dist, file), 'utf8'))) problems.push(`${file}: ${p}`)
+  }
+  for (const name of relativeImports(entry)) {
+    if (!fs.existsSync(path.join(dist, name))) {
+      problems.push(`entry.js imports ./${name}, which is not in dist/ — the chunk would load and that import would fail`)
+    }
+  }
+
   if (problems.length) {
     console.error('\nThe built chunk breaks the shared-dependency rule:\n')
     for (const p of problems) console.error(`  - ${p}\n`)
     process.exit(1)
   }
   const kb = (fs.statSync(CHUNK).size / 1024).toFixed(1)
-  console.log(`OK — dist/entry.js (${kb} kB) has no bare imports and bundles no shared dependency.`)
+  const split = relativeImports(entry)
+  console.log(
+    `OK — dist/entry.js (${kb} kB) has no bare imports and bundles no shared dependency` +
+      (split.length ? `; its ${split.length} split chunk(s) (${split.join(', ')}) are present and clean.` : '.'),
+  )
 }