feat(rust): the live map (phase 14, protocol 11)

PLAN.md §30 as approved, plus D119/D120 from the build.

Server:
- rust_map_images (one row per server: picture as MEDIUMBLOB, geometry,
  monuments, DERIVATION_VERSION) and rust_map_overrides; purge.sql pair.
- mapImages.js: D110. The board poll notices a new boot/wipe/seed/size and
  asks map.info; a new key or hash from the free Rust+ cache (or a render
  kept on disk) is fetched in slices, checked against its SHA-256 and stored
  in one statement. One fetch per server, a backoff on failure, `stale`
  abandons a fetch that straddles a map change. Render now (D109) is
  admin-only and watched to completion.
- mapLive.js: D111. One map.live per server per 5 s whoever asks; positions
  are held in memory only.
- model/map: four layers (world, events public; players, bases staff), a
  fleet default plus per-server override (D114), the players layer capped by
  presence (D113), own dot and online first-party clan mates for a linked
  viewer (D115, D117, D118). A layer the viewer may not see is absent from
  the answer, never sent and hidden.
- Routes: public /servers/:id/map, /map/image (immutable under its hash),
  /map/live; admin /servers/:id/map/fetch and /render; the Map card on the
  visibility PUT. Swagger fragment and frozen manifest regenerated.

Client:
- A Map tab: Leaflet over the picture in CRS.Simple, the game's own grid
  (labels only when a cell is wide enough to hold one), a legend that lists
  hidden layers with who can see them, polled every 10 s while visible.
- D120: Leaflet is a lazy split chunk beside entry.js, not in it. release.yml
  copies every dist/*.js; checkExternals and build.test.js hold both ends.
- The Map card on Admin -> Rust visibility, with Fetch again and Render now.

Capability `map` declared for the Android app (phase 15).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/sidecarClient.js

@@ -65,7 +65,9 @@ const TIMEOUT_MS = 12000
  * `/world/revert` — what an event places in the world and gives back (PLAN.md
  * §28); **10** adds the rewards — `/tally/open`, `/tally/snapshot`,
  * `/tally/close`, `/kits` and `/chat`, and a `credits` field on the permission
- * sync (PLAN.md §29). The bump lands here in the same change as the emitters,
+ * sync (PLAN.md §29); **11** adds the map — `/map`, `/map/chunk`,
+ * `/map/render` and `/map/live`, its picture and what moves on it (PLAN.md
+ * §30). The bump lands here in the same change as the emitters,
  * because the sidecar refuses a client declaring a different version with a
  * `409`: a module left on 2 would stop being able to read the server board it
  * has been reading all along. A constant that lags the deployment is not a safe
@@ -75,7 +77,7 @@ const TIMEOUT_MS = 12000
  * deployment into a `409` naming both numbers instead of a parse failure three
  * layers further in.
  */
-const PROTOCOL_VERSION = 10
+const PROTOCOL_VERSION = 11
 
 /** What a caller gets back. Shaped once so every call site reads the same. */
 function reply(ok, status, data = null) {
@@ -386,6 +388,36 @@ const kits = (server) => request(server, '/kits')
  */
 const chat = (server, body) => request(server, '/chat', { method: 'POST', body })
 
+/**
+ * What one server's map is and where its picture comes from (protocol 11,
+ * stage one): `mapKey`, `source` (`companion`, `rendered` or `none`), the
+ * picture's size, `sha256` and slice count, the grid, and the monuments.
+ * `hashing: true` in place of `sha256` means ask again in a moment. A refusal
+ * is `data.kind` `map.error`, like every other write-shaped answer here.
+ */
+const mapInfo = (server) => request(server, '/map')
+
+/**
+ * One slice of the picture, base64 in `data.data` (stage two). `map.error`
+ * `stale` when the map or picture moved since `mapInfo` — the caller starts
+ * again rather than splicing two maps.
+ */
+const mapChunk = (server, { mapKey, sha256, n }) =>
+  request(
+    server,
+    `/map/chunk?mapKey=${encodeURIComponent(mapKey)}&sha256=${encodeURIComponent(sha256)}&n=${encodeURIComponent(n)}`,
+  )
+
+/**
+ * Ask the game to draw its own map (D109). Answered `accepted` at once; the
+ * render stalls the game on a LATER frame, and `mapInfo` says `rendered` when
+ * it is done.
+ */
+const mapRender = (server, body) => request(server, '/map/render', { method: 'POST', body })
+
+/** Everything that moves on one server's map, every layer, unfiltered. The caller filters (§8.5). */
+const mapLive = (server) => request(server, '/map/live')
+
 module.exports = {
   TIMEOUT_MS,
   LEASE_TIMEOUT_MS,
@@ -417,5 +449,9 @@ module.exports = {
   tallyClose,
   kits,
   chat,
+  mapInfo,
+  mapChunk,
+  mapRender,
+  mapLive,
   joinUrl,
 }