feat(rust): notifications and engagement (phase 10, protocol 7)

Registers the engagement set R7 put in v1: thirteen triggers, four push
streams, three audiences, four bodies (two triggers, email and in-app)
and thirteen disabled rules in seven groups (PLAN.md §25, D59-D68).

The raid alert goes to everyone authorised on the tool cupboard, one
emit per linked person with ownerUserId, so the owner ceiling holds per
emit. It covers doors and walls (protocol 7), never names the raider,
alerts nobody when there is no cupboard, and carries ownerOnline so
"offline only" is the seeded rule's condition rather than code.

The fan-out runs off ingest before a frame is applied, since applying a
disband deletes the roster the notice is sent to. A replayed event is
told only while it is news: 15 minutes for broadcasts, 24 hours for
personal and staff events. Dedupe keys come from the event, not the
sidecar's row id. Server online/offline and a new kills leader are
in-memory transitions, never on first sight, and a tie is not a lead.
A login with no approval within a minute becomes a staff notice via a
query, so a restart loses nothing.

Also fixes a phase-4 gap (D68): the refresh now asks /health, so a game
that hung, or whose bridge was unloaded, while the sidecar stayed up no
longer reads as online. It stops naming players as online, and a stale
board no longer moves "last seen".

engagement-triggers.json is the committed freeze of all of it, checked
in CI with line endings normalised. The check was verified by breaking
it both ways.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/index.js

@@ -52,6 +52,10 @@ module.exports = function register(ctx, api) {
   const adminRust = require('./router/admin/rust.router')
   const usersRust = require('./router/admin/usersRust.router')
   const teamProvider = require('./model/clans/teamProvider')
+  const { TRIGGERS } = require('./engagement/triggers')
+  const { STREAMS } = require('./engagement/streams')
+  const { AUDIENCES } = require('./engagement/audiences')
+  const seeds = require('./engagement/seeds')
   const boot = require('./boot')
   /* eslint-enable global-require */
 
@@ -105,6 +109,31 @@ module.exports = function register(ctx, api) {
   // UO + Rust site; it is recorded in §24 rather than worked around here.
   api.registerTeamProvider(teamProvider)
 
+  // Notifications and engagement (R7, PLAN.md §25). Four registrations that are
+  // one decision, because they only mean something together:
+  //
+  //   triggers   what can happen, what a template may say about it, and the
+  //              widest audience a rule on it may EVER have — the security
+  //              boundary; core refuses a rule that widens a ceiling
+  //   streams    which of those may reach a phone. Core pushes an engagement
+  //              rule only to devices subscribed to a stream of the SAME id, so
+  //              a trigger missing here can never buzz anybody (D65)
+  //   audiences  named sets of people over this module's data, for an operator
+  //              to point a rule at; each answers user ids and nothing else
+  //   seeds      the two bodies worth writing, and one disabled rule group per
+  //              family — installing this module mails nobody
+  //
+  // What fires them is `engagement/emit.js`, off the ingest cursor and the
+  // refresh. Registration is a claim, not a call: nothing here touches the
+  // database, and the seeds are written by core after the schema is up.
+  //
+  // **Not registered, and that is D62:** no announce leg and no post hook. Both
+  // need something in game to deliver to, and phase 10 reaches no game.
+  api.registerEventTriggers(TRIGGERS)
+  api.registerNotificationStreams(STREAMS)
+  api.registerAudiences(AUDIENCES)
+  api.registerEngagementSeeds({ templates: seeds.TEMPLATES, ruleGroups: seeds.RULE_GROUPS })
+
   // The lifecycle hooks (§2.5). `onBoot` runs after core's schema, after this
   // module's schema fragment, and BEFORE the HTTP listener binds — so a module
   // that must not serve traffic until it has warmed a cache gets that for free.
@@ -117,10 +146,9 @@ module.exports = function register(ctx, api) {
   api.onBoot(boot.onBoot)
   api.onShutdown(boot.onShutdown)
 
-  // Everything else this module will register — the event triggers and
-  // audiences, the engagement seeds, the four event catalogues, the
-  // notification streams and the slash commands — is deliberately absent. Each
-  // arrives with the phase that has something real to put in it. A registration
+  // Everything else this module will register — the four event catalogues, the
+  // announce leg and the slash commands — is deliberately absent. Each arrives
+  // with the phase that has something real to put in it. A registration
   // with nothing behind it is worse than a missing one: a declared trigger
   // nothing emits and a declared slot nothing fills are both surfaces an operator
   // can configure and then wait on.
@@ -130,5 +158,8 @@ module.exports = function register(ctx, api) {
     routes: 'public:/rust player:/rust admin:/rust',
     extensions: 'admin.users.detail',
     teams: 'first-party clans',
+    triggers: TRIGGERS.length,
+    streams: STREAMS.length,
+    audiences: AUDIENCES.length,
   })
 }