feat(rust): site-owned permissions — the site is the author, the game is the cache

R2, and the first phase where this module WRITES to a game. Groups and grants are
authored on the website and pushed into each server's own permission store, so
every plugin that already calls `UserHasPermission` honours them with no adapter,
and a wipe stops being a data-loss event.

**Seven org-lead decisions (D28-D34).** A grant is keyed to the website USER and
resolved to every Steam id they have linked at push time (D28); every authored row
carries a scope — a server or `*` (D29); groups are mirrored as real groups rather
than flattened (D30); a holder the site did not author is REPORTED, never undone,
with adopt and revoke offered (D31); one verb, with the plugin diffing locally
(D32); a permission no server has registered is reported unresolved and never
self-registered (D33); authoring is people and groups by hand, with rules deferred
(D34).

**Three sets, and every interesting question is a difference between two.**
`desired − pushed` is what to apply; `pushed − desired` is what to RETIRE, because
the site put it there and has since withdrawn it; `present − desired` is drift. The
middle one is why `rust_perm_pushed` exists: a name in the store that is not in the
desired set is either something the site retired or something a human granted, and
those two have opposite correct answers.

**What lands is not what was sent.** A grant naming a permission the server has not
registered did not land — `GrantUserPermission` no-ops silently — and a member the
store has never seen could not be placed. Neither is recorded as pushed, so the
site never believes it gave a privilege it did not.

The loop asks a cheap question every thirty seconds — does the digest of the
desired set still equal what this server last confirmed — and syncs on a change, a
restart, a wipe, a drift hook, a failed attempt past its backoff, or the
fifteen-minute audit that finds drift on a server nobody has touched.

**This module's first admin page**, because a permission model is the first thing
here that has to be composed rather than configured. What is on it is decided by
what an operator can get wrong: four states are invisible from the game and from a
list of grants, and each is a sentence rather than a number.

Walked end to end against a real core at the pinned ref, the real sidecar, and a
stand-in speaking protocol 4 — including a restart that emptied the store and was
fully re-pushed. Four defects the browser found that 133 green tests did not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PMH6bw1jXMgbyF3ZWGEzSM

server/ingest.js

@@ -35,6 +35,7 @@ const core = require('./core')
 
 const db = require('./model/events/events.db')
 const links = require('./model/links/links.model')
+const permissionsDb = require('./model/permissions/permissions.db')
 const sidecar = require('./sidecarClient')
 
 const log = core.logger('ingest')
@@ -173,6 +174,23 @@ async function apply(serverId, item) {
       await db.touchPlayer(frame.steamId, frame.name || null)
       break
 
+    // ── Protocol 4: somebody changed the permission store, and it was not us ──
+    //
+    // The plugin raises this only for writes it did not make itself — its own
+    // sync suppresses the hooks while it applies (PROTOCOL.md §10.4). What
+    // arrives here is therefore a hand edit, a console command, or another
+    // plugin granting something.
+    //
+    // **It is a reason to reconcile, not the reconciliation.** This frame cannot
+    // say whether the change is foreign: only the desired set can, and that
+    // comparison happens in the sync. So the server is marked dirty and the next
+    // tick produces the authoritative answer — which means a hook that stops
+    // firing on a framework upgrade costs latency and nothing else. The audit
+    // interval finds the same drift within fifteen minutes either way.
+    case 'perm.drift':
+      await permissionsDb.markDirty(serverId)
+      break
+
     default:
       // Stored, not counted. Moderation frames, the server lifecycle, and
       // anything a newer protocol sends that this build does not understand.