feat(rust): site-owned permissions — the site is the author, the game is the cache

R2, and the first phase where this module WRITES to a game. Groups and grants are
authored on the website and pushed into each server's own permission store, so
every plugin that already calls `UserHasPermission` honours them with no adapter,
and a wipe stops being a data-loss event.

**Seven org-lead decisions (D28-D34).** A grant is keyed to the website USER and
resolved to every Steam id they have linked at push time (D28); every authored row
carries a scope — a server or `*` (D29); groups are mirrored as real groups rather
than flattened (D30); a holder the site did not author is REPORTED, never undone,
with adopt and revoke offered (D31); one verb, with the plugin diffing locally
(D32); a permission no server has registered is reported unresolved and never
self-registered (D33); authoring is people and groups by hand, with rules deferred
(D34).

**Three sets, and every interesting question is a difference between two.**
`desired − pushed` is what to apply; `pushed − desired` is what to RETIRE, because
the site put it there and has since withdrawn it; `present − desired` is drift. The
middle one is why `rust_perm_pushed` exists: a name in the store that is not in the
desired set is either something the site retired or something a human granted, and
those two have opposite correct answers.

**What lands is not what was sent.** A grant naming a permission the server has not
registered did not land — `GrantUserPermission` no-ops silently — and a member the
store has never seen could not be placed. Neither is recorded as pushed, so the
site never believes it gave a privilege it did not.

The loop asks a cheap question every thirty seconds — does the digest of the
desired set still equal what this server last confirmed — and syncs on a change, a
restart, a wipe, a drift hook, a failed attempt past its backoff, or the
fifteen-minute audit that finds drift on a server nobody has touched.

**This module's first admin page**, because a permission model is the first thing
here that has to be composed rather than configured. What is on it is decided by
what an operator can get wrong: four states are invisible from the game and from a
list of grants, and each is a sentence rather than a number.

Walked end to end against a real core at the pinned ref, the real sidecar, and a
stand-in speaking protocol 4 — including a restart that emptied the store and was
fully re-pushed. Four defects the browser found that 133 green tests did not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PMH6bw1jXMgbyF3ZWGEzSM

server/boot.js

@@ -44,6 +44,7 @@ const core = require('./core')
 const db = require('./model/servers/servers.db')
 const eventsDb = require('./model/events/events.db')
 const ingest = require('./ingest')
+const permSync = require('./permSync')
 const servers = require('./model/servers/servers.model')
 const sidecar = require('./sidecarClient')
 
@@ -190,6 +191,11 @@ async function prune() {
 
 async function onBoot() {
   await refresh()
+  // The permission mirror owns its own loop and its own cadence (see
+  // `permSync.js`). It is started rather than run here: a first pass would write
+  // to every configured game server before the website had finished booting, and
+  // nothing about R2 is urgent enough to delay a listener for.
+  permSync.start()
   refreshTimer = setInterval(refresh, REFRESH_MS)
   ingestTimer = setInterval(ingestAll, INGEST_MS)
   pruneTimer = setInterval(prune, PRUNE_MS)
@@ -200,7 +206,7 @@ async function onBoot() {
     if (timer && typeof timer.unref === 'function') timer.unref()
   }
 
-  log.info('booted', { refreshMs: REFRESH_MS, ingestMs: INGEST_MS })
+  log.info('booted', { refreshMs: REFRESH_MS, ingestMs: INGEST_MS, permSyncMs: permSync.TICK_MS })
 }
 
 /**
@@ -212,6 +218,8 @@ async function onBoot() {
  * rather than cancelled, since nothing can stop a promise that is still running.
  */
 async function onShutdown() {
+  permSync.stop()
+
   for (const timer of [refreshTimer, ingestTimer, pruneTimer]) {
     if (timer) clearInterval(timer)
   }