feat(rust): the live map (phase 14, protocol 11)

PLAN.md §30 as approved, plus D119/D120 from the build.

Server:
- rust_map_images (one row per server: picture as MEDIUMBLOB, geometry,
  monuments, DERIVATION_VERSION) and rust_map_overrides; purge.sql pair.
- mapImages.js: D110. The board poll notices a new boot/wipe/seed/size and
  asks map.info; a new key or hash from the free Rust+ cache (or a render
  kept on disk) is fetched in slices, checked against its SHA-256 and stored
  in one statement. One fetch per server, a backoff on failure, `stale`
  abandons a fetch that straddles a map change. Render now (D109) is
  admin-only and watched to completion.
- mapLive.js: D111. One map.live per server per 5 s whoever asks; positions
  are held in memory only.
- model/map: four layers (world, events public; players, bases staff), a
  fleet default plus per-server override (D114), the players layer capped by
  presence (D113), own dot and online first-party clan mates for a linked
  viewer (D115, D117, D118). A layer the viewer may not see is absent from
  the answer, never sent and hidden.
- Routes: public /servers/:id/map, /map/image (immutable under its hash),
  /map/live; admin /servers/:id/map/fetch and /render; the Map card on the
  visibility PUT. Swagger fragment and frozen manifest regenerated.

Client:
- A Map tab: Leaflet over the picture in CRS.Simple, the game's own grid
  (labels only when a cell is wide enough to hold one), a legend that lists
  hidden layers with who can see them, polled every 10 s while visible.
- D120: Leaflet is a lazy split chunk beside entry.js, not in it. release.yml
  copies every dist/*.js; checkExternals and build.test.js hold both ends.
- The Map card on Admin -> Rust visibility, with Fetch again and Render now.

Capability `map` declared for the Android app (phase 15).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/visibility/visibility.model.js

@@ -93,19 +93,30 @@ const meets = (viewer, required) => viewerRank(viewer) >= requiredRank(required)
  * question about somebody's standing must grant nothing.
  */
 async function viewerLevel(req) {
+  return (await viewer(req)).level
+}
+
+/**
+ * The viewer's rung AND who they are, from the same re-read row — `{ level,
+ * userId }`, with `userId` null for anybody who resolves to `public`. The map's
+ * own-and-mates view (D115) needs the id, and it must come from the row that
+ * decided the rung: a banned account is nobody, whatever its token names.
+ */
+async function viewer(req) {
+  const nobody = { level: 'public', userId: null }
   try {
     const claimed = req.user || core.auth.getUserFromRequest(req)
-    if (!claimed || claimed.id == null) return 'public'
+    if (!claimed || claimed.id == null) return nobody
 
     const user = await core.users.getById(claimed.id)
-    if (!user) return 'public'
-    if (user.status && user.status !== 'active') return 'public'
+    if (!user) return nobody
+    if (user.status && user.status !== 'active') return nobody
 
-    if (user.role === 'admin' || user.role === 'moderator') return 'staff'
-    return 'signed_in'
+    const level = user.role === 'admin' || user.role === 'moderator' ? 'staff' : 'signed_in'
+    return { level, userId: user.id != null ? user.id : claimed.id }
   } catch (err) {
     log.warn('could not resolve the viewer; treating them as anonymous', { error: err.message })
-    return 'public'
+    return nobody
   }
 }
 
@@ -278,6 +289,7 @@ module.exports = {
   meets,
   normalise,
   viewerLevel,
+  viewer,
   fleetPresence,
   presenceFor,
   canSeePresence,