feat(rust): the live map (phase 14, protocol 11)

PLAN.md §30 as approved, plus D119/D120 from the build.

Server:
- rust_map_images (one row per server: picture as MEDIUMBLOB, geometry,
  monuments, DERIVATION_VERSION) and rust_map_overrides; purge.sql pair.
- mapImages.js: D110. The board poll notices a new boot/wipe/seed/size and
  asks map.info; a new key or hash from the free Rust+ cache (or a render
  kept on disk) is fetched in slices, checked against its SHA-256 and stored
  in one statement. One fetch per server, a backoff on failure, `stale`
  abandons a fetch that straddles a map change. Render now (D109) is
  admin-only and watched to completion.
- mapLive.js: D111. One map.live per server per 5 s whoever asks; positions
  are held in memory only.
- model/map: four layers (world, events public; players, bases staff), a
  fleet default plus per-server override (D114), the players layer capped by
  presence (D113), own dot and online first-party clan mates for a linked
  viewer (D115, D117, D118). A layer the viewer may not see is absent from
  the answer, never sent and hidden.
- Routes: public /servers/:id/map, /map/image (immutable under its hash),
  /map/live; admin /servers/:id/map/fetch and /render; the Map card on the
  visibility PUT. Swagger fragment and frozen manifest regenerated.

Client:
- A Map tab: Leaflet over the picture in CRS.Simple, the game's own grid
  (labels only when a cell is wide enough to hold one), a legend that lists
  hidden layers with who can see them, polled every 10 s while visible.
- D120: Leaflet is a lazy split chunk beside entry.js, not in it. release.yml
  copies every dist/*.js; checkExternals and build.test.js hold both ends.
- The Map card on Admin -> Rust visibility, with Fetch again and Render now.

Capability `map` declared for the Android app (phase 15).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

client/src/lib/leaflet.js

@@ -0,0 +1,28 @@
+// ── Leaflet, and only when the Map tab asks for it ────────────────────────
+//
+// D116 put Leaflet on the map; D120 put it HERE, in a chunk of its own that the
+// Map tab imports with `import()`. Two reasons, and both are about `entry.js`:
+//
+//   • `entry.js` is loaded on EVERY page of the site, because core injects every
+//     started module's chunk into its shell. Leaflet in it would be ~40 KB gz on
+//     the home page, the forum and the news, for a tab most visitors never open.
+//   • Leaflet touches `document` and `window` the moment it is evaluated. The
+//     chunk is evaluated in Node by `test/registration.test.js`, with a
+//     `window` and nothing else — so Leaflet in the entry chunk fails that test
+//     at import, before a single registration is checked.
+//
+// Vite emits this as `dist/map-<hash>.js` beside `entry.js`. Core serves the
+// directory `client.entry` sits in (MODULE_API.md §3.1), and `release.yml`
+// copies every `.js` in it — `test/build.test.js` holds both ends of that.
+//
+// The ESM build is imported by path: Leaflet 1.9.4's package.json names only its
+// UMD file, and the UMD one would go through CommonJS interop for nothing.
+//
+// The stylesheet comes in as a STRING and is injected once as a `<style>` by the
+// page (core's CSP allows `style-src 'unsafe-inline'`). The map uses circle and
+// div markers only, so the images Leaflet's CSS names are never shown.
+
+import * as L from 'leaflet/dist/leaflet-src.esm.js'
+import css from 'leaflet/dist/leaflet.css?inline'
+
+export { L, css }