feat(rust): the live map (phase 14, protocol 11)

PLAN.md §30 as approved, plus D119/D120 from the build.

Server:
- rust_map_images (one row per server: picture as MEDIUMBLOB, geometry,
  monuments, DERIVATION_VERSION) and rust_map_overrides; purge.sql pair.
- mapImages.js: D110. The board poll notices a new boot/wipe/seed/size and
  asks map.info; a new key or hash from the free Rust+ cache (or a render
  kept on disk) is fetched in slices, checked against its SHA-256 and stored
  in one statement. One fetch per server, a backoff on failure, `stale`
  abandons a fetch that straddles a map change. Render now (D109) is
  admin-only and watched to completion.
- mapLive.js: D111. One map.live per server per 5 s whoever asks; positions
  are held in memory only.
- model/map: four layers (world, events public; players, bases staff), a
  fleet default plus per-server override (D114), the players layer capped by
  presence (D113), own dot and online first-party clan mates for a linked
  viewer (D115, D117, D118). A layer the viewer may not see is absent from
  the answer, never sent and hidden.
- Routes: public /servers/:id/map, /map/image (immutable under its hash),
  /map/live; admin /servers/:id/map/fetch and /render; the Map card on the
  visibility PUT. Swagger fragment and frozen manifest regenerated.

Client:
- A Map tab: Leaflet over the picture in CRS.Simple, the game's own grid
  (labels only when a cell is wide enough to hold one), a legend that lists
  hidden layers with who can see them, polled every 10 s while visible.
- D120: Leaflet is a lazy split chunk beside entry.js, not in it. release.yml
  copies every dist/*.js; checkExternals and build.test.js hold both ends.
- The Map card on Admin -> Rust visibility, with Fetch again and Render now.

Capability `map` declared for the Android app (phase 15).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/router/admin/rust.controller.js

@@ -13,6 +13,7 @@
 const core = require('../../core')
 
 const db = require('../../model/servers/servers.db')
+const mapImages = require('../../mapImages')
 const servers = require('../../model/servers/servers.model')
 const sidecar = require('../../sidecarClient')
 
@@ -129,4 +130,57 @@ async function testServer(req, res) {
   }
 }
 
-module.exports = { listServers, putServer, deleteServer, testServer }
+/**
+ * Fetch one server's map picture again (D110's admin button). Runs the same
+ * fetch the board poll triggers, forced — the stored hash is not trusted to be
+ * current — and answers what it did, because an operator pressing this is
+ * asking a question: is the picture this server has the right one?
+ */
+async function fetchMap(req, res) {
+  const { id } = req.params
+
+  try {
+    const server = await servers.getForCalling(id)
+    if (!server) return res.status(404).json({ message: 'No such server, or it is disabled' })
+
+    const result = await mapImages.run(server, null, { force: true })
+    await core.activity.log({ req, action: 'rust.map.fetch', detail: { server: id, outcome: result.outcome } })
+
+    if (result.outcome === 'busy') return res.status(409).json({ message: 'A fetch is already running for this server.' })
+    return res.status(result.ok ? 200 : 502).json({ ok: result.ok, outcome: result.outcome, message: result.detail || null })
+  } catch (err) {
+    log.error('failed to fetch a map', { server: id, error: err.message })
+    return res.status(500).json({ message: 'Failed to fetch the map' })
+  }
+}
+
+/**
+ * Ask a server with no picture to draw one (D109). **This stalls that game**
+ * for seconds — the card says how many before the button is pressed — and it is
+ * refused by the plugin when a picture already exists. Answered as soon as the
+ * game accepts; the picture is fetched when the render finishes.
+ */
+async function renderMap(req, res) {
+  const { id } = req.params
+
+  try {
+    const server = await servers.getForCalling(id)
+    if (!server) return res.status(404).json({ message: 'No such server, or it is disabled' })
+
+    const actor = req.user && (req.user.username || req.user.id)
+    const result = await mapImages.render(server, actor != null ? String(actor) : null)
+    await core.activity.log({
+      req,
+      action: 'rust.map.render',
+      detail: { server: id, accepted: result.ok, ...(result.ok ? {} : { reason: result.reason || null }) },
+    })
+
+    if (!result.ok) return res.status(result.status || 502).json({ message: result.message })
+    return res.status(202).json({ accepted: true, stallSeconds: result.stallSeconds })
+  } catch (err) {
+    log.error('failed to ask for a render', { server: id, error: err.message })
+    return res.status(500).json({ message: 'Failed to ask the server to draw its map' })
+  }
+}
+
+module.exports = { listServers, putServer, deleteServer, testServer, fetchMap, renderMap }