feat(rust): the live map (phase 14, protocol 11)

PLAN.md §30 as approved, plus D119/D120 from the build.

Server:
- rust_map_images (one row per server: picture as MEDIUMBLOB, geometry,
  monuments, DERIVATION_VERSION) and rust_map_overrides; purge.sql pair.
- mapImages.js: D110. The board poll notices a new boot/wipe/seed/size and
  asks map.info; a new key or hash from the free Rust+ cache (or a render
  kept on disk) is fetched in slices, checked against its SHA-256 and stored
  in one statement. One fetch per server, a backoff on failure, `stale`
  abandons a fetch that straddles a map change. Render now (D109) is
  admin-only and watched to completion.
- mapLive.js: D111. One map.live per server per 5 s whoever asks; positions
  are held in memory only.
- model/map: four layers (world, events public; players, bases staff), a
  fleet default plus per-server override (D114), the players layer capped by
  presence (D113), own dot and online first-party clan mates for a linked
  viewer (D115, D117, D118). A layer the viewer may not see is absent from
  the answer, never sent and hidden.
- Routes: public /servers/:id/map, /map/image (immutable under its hash),
  /map/live; admin /servers/:id/map/fetch and /render; the Map card on the
  visibility PUT. Swagger fragment and frozen manifest regenerated.

Client:
- A Map tab: Leaflet over the picture in CRS.Simple, the game's own grid
  (labels only when a cell is wide enough to hold one), a legend that lists
  hidden layers with who can see them, polled every 10 s while visible.
- D120: Leaflet is a lazy split chunk beside entry.js, not in it. release.yml
  copies every dist/*.js; checkExternals and build.test.js hold both ends.
- The Map card on Admin -> Rust visibility, with Fetch again and Render now.

Capability `map` declared for the Android app (phase 15).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/router/admin/rust.router.js

@@ -101,4 +101,37 @@ adminRustRouter.post(
   admin.testServer,
 )
 
+// ── The map's picture (phase 14) ──────────────────────────────────────────
+
+adminRustRouter.post(
+  '/servers/:id/map/fetch',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Fetch a server’s map picture again'
+  // #swagger.description = 'Asks the game what its map is and fetches the picture again, whatever this site already holds. The site does this by itself the first time it sees a new map when the game has a picture to give; this is the button for when that did not happen. `outcome` is `fetched`, `current` (the stored picture is this map’s), `none` (the game has no picture, and Render now is the way to get one) or `failed`, with a sentence in `message`. One fetch per server at a time: a second answers 409.'
+  // #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
+  /* #swagger.responses[200] = { description: 'What the fetch did' } */
+  /* #swagger.responses[404] = { description: 'No such server, or it is disabled' } */
+  /* #swagger.responses[409] = { description: 'A fetch is already running for this server' } */
+  /* #swagger.responses[502] = { description: 'The game or its sidecar did not give a picture; the stored one is kept' } */
+  requireRole('admin'),
+  param('id').isString().isLength({ min: 1, max: 64 }),
+  validate,
+  admin.fetchMap,
+)
+
+adminRustRouter.post(
+  '/servers/:id/map/render',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Ask a server to draw its own map'
+  // #swagger.description = '**This stalls the game server** while it draws — about 8.5 seconds on a 3000 map, longer on a larger one — and nothing on it moves for that time. It exists for a server without Rust+ (`app.port`), whose game keeps no picture of its map, and is refused when a picture already exists. Answers 202 as soon as the game accepts; the picture is fetched when the render finishes, and kept by the game so a restart on the same map does not need another.'
+  // #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
+  /* #swagger.responses[202] = { description: 'The game accepted and will draw on its next frame' } */
+  /* #swagger.responses[404] = { description: 'No such server, or it is disabled' } */
+  /* #swagger.responses[409] = { description: 'A picture already exists, or a render is already running' } */
+  requireRole('admin'),
+  param('id').isString().isLength({ min: 1, max: 64 }),
+  validate,
+  admin.renderMap,
+)
+
 module.exports = adminRustRouter