feat(rust): the live map (phase 14, protocol 11)

PLAN.md §30 as approved, plus D119/D120 from the build.

Server:
- rust_map_images (one row per server: picture as MEDIUMBLOB, geometry,
  monuments, DERIVATION_VERSION) and rust_map_overrides; purge.sql pair.
- mapImages.js: D110. The board poll notices a new boot/wipe/seed/size and
  asks map.info; a new key or hash from the free Rust+ cache (or a render
  kept on disk) is fetched in slices, checked against its SHA-256 and stored
  in one statement. One fetch per server, a backoff on failure, `stale`
  abandons a fetch that straddles a map change. Render now (D109) is
  admin-only and watched to completion.
- mapLive.js: D111. One map.live per server per 5 s whoever asks; positions
  are held in memory only.
- model/map: four layers (world, events public; players, bases staff), a
  fleet default plus per-server override (D114), the players layer capped by
  presence (D113), own dot and online first-party clan mates for a linked
  viewer (D115, D117, D118). A layer the viewer may not see is absent from
  the answer, never sent and hidden.
- Routes: public /servers/:id/map, /map/image (immutable under its hash),
  /map/live; admin /servers/:id/map/fetch and /render; the Map card on the
  visibility PUT. Swagger fragment and frozen manifest regenerated.

Client:
- A Map tab: Leaflet over the picture in CRS.Simple, the game's own grid
  (labels only when a cell is wide enough to hold one), a legend that lists
  hidden layers with who can see them, polled every 10 s while visible.
- D120: Leaflet is a lazy split chunk beside entry.js, not in it. release.yml
  copies every dist/*.js; checkExternals and build.test.js hold both ends.
- The Map card on Admin -> Rust visibility, with Fetch again and Render now.

Capability `map` declared for the Android app (phase 15).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/db/purge.sql

@@ -19,6 +19,10 @@
 -- it knows this module registered, because it is the side that knows which
 -- registrant owned what.
 
+-- Phase 14.
+DROP TABLE IF EXISTS rust_map_overrides;
+DROP TABLE IF EXISTS rust_map_images;
+
 -- Phase 13b.
 DROP TABLE IF EXISTS rust_perm_run_grants;
 

server/db/schema.sql

@@ -840,3 +840,63 @@ CREATE TABLE IF NOT EXISTS rust_perm_run_grants (
 -- post, and without it the day this module updates every post would start
 -- appearing in every server's chat.
 ALTER TABLE rust_servers ADD COLUMN IF NOT EXISTS announce_news TINYINT(1) NOT NULL DEFAULT 0;
+
+-- ── The map (phase 14, protocol 11) ───────────────────────────────────────
+--
+-- One row per server holding the picture of its CURRENT map (PLAN.md §30.2),
+-- replaced whole when the map changes. The picture lives here and not in core's
+-- `/uploads`, which core serves to anybody by URL and no purge would reach
+-- (§30.5). One row per server bounds it at about a megabyte each.
+--
+-- `bytes` and `sha256` are NULL for a server whose game has no picture yet
+-- (`source = 'none'`): the row still carries the geometry and the monuments, so
+-- the page can draw the live layers on a plain background, and an admin's
+-- render replaces it. `map_key` says WHICH map and `sha256` which picture of it.
+--
+-- `derivation` is `DERIVATION_VERSION` (R9) — how the geometry columns were
+-- worked out from what the plugin said. A row whose number is older is
+-- re-derived from a fresh `map.info` without fetching the bytes again.
+--
+-- `monuments` is JSON as the plugin sent it: kind, label, the `kind#n` token and
+-- x/z. It changes only with the map, so it belongs to this row and not to the
+-- live answer.
+CREATE TABLE IF NOT EXISTS rust_map_images (
+  server_id       VARCHAR(64)    NOT NULL PRIMARY KEY,
+  map_key         VARCHAR(160)   NOT NULL,
+  sha256          CHAR(64)       NULL,
+  source          VARCHAR(16)    NOT NULL,
+  width           INT UNSIGNED   NOT NULL,
+  height          INT UNSIGNED   NOT NULL,
+  ocean_margin    INT UNSIGNED   NOT NULL,
+  world_size      INT UNSIGNED   NOT NULL,
+  grid_cells      INT UNSIGNED   NOT NULL,
+  grid_cell_size  DECIMAL(10,3)  NOT NULL,
+  background      VARCHAR(16)    NULL,
+  derivation      INT UNSIGNED   NOT NULL,
+  monuments       MEDIUMTEXT     NOT NULL,
+  bytes           MEDIUMBLOB     NULL,
+  fetched_at      DATETIME       NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT fk_rust_map_images_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Per-server overrides of the map's switches (D114): a layer's audience, or the
+-- own-and-mates view. The fleet defaults are rows in `rust_settings`
+-- (`map.layer.<layer>.audience`, `map.mates`); a server with no row here
+-- inherits them. A table of its own rather than five more columns on
+-- `rust_servers`, because the set of switches is the part most likely to grow.
+--
+-- `value` is a word (`staff` · `signed_in` · `public`, or `on` · `off`), and a
+-- word this build does not recognise NARROWS (`model/map`).
+CREATE TABLE IF NOT EXISTS rust_map_overrides (
+  server_id   VARCHAR(64)  NOT NULL,
+  setting     VARCHAR(64)  NOT NULL,
+  value       VARCHAR(16)  NOT NULL,
+  updated_by  INT          NULL,
+  updated_at  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (server_id, setting),
+  CONSTRAINT fk_rust_map_overrides_server
+    FOREIGN KEY (server_id) REFERENCES rust_servers (id) ON DELETE CASCADE,
+  CONSTRAINT fk_rust_map_overrides_user
+    FOREIGN KEY (updated_by) REFERENCES users (id) ON DELETE SET NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;