feat(rust): Run console commands and Reward by console command (PLAN_REDESIGNS §16)

Two event steps in server/eventCommands.js, on one new budget,
`rust.commands` (D382-D385):

- rust.command.run: up to 10 typed commands once on one server, with
  optional teardown commands. irreversible / ledger: the ledger row keeps
  the teardown as it was, and core reverts it when the run ends or is
  cancelled. Priced one unit per command, teardown included.
- rust.command.reward: the kit reward's recipient picker (tally modes and
  linked), by Steam id, so no website account is needed. The bridge fills
  {steamid} and {name}; offline recipients are skipped and named (D383).
  irreversible / none. Priced commands x people, the bound for a mode that
  is not a count.

Both take core's `multiple` string field as a free text box (no
allowlist, D384) and a required "I am sure" toggle. {steamid}/{name} in a
run step are refused. unknown-command, malformed, events-disabled,
interrupted are permanent; the error says how many ran before it.

D385: the run also hands its teardown to the bridge, which keeps it with
the key. A revert with only the key (the step failed, or its answer was
lost, so core recorded nothing) asks every enabled server to run what it
kept; a server the step never reached runs nothing.

sidecarClient.commandsRun -> POST /commands/run; ci/bundle.json lists the
new file; entry.test.js pins the new ids; 21 tests in
test/commandSteps.test.js.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/sidecarClient.js

@@ -452,6 +452,17 @@ const dtStart = (server, body) => request(server, '/dt/start', { method: 'POST',
  */
 const gcPlace = (server, body) => request(server, '/gc/place', { method: 'POST', body })
 
+/**
+ * Run console commands a step's author typed (protocol 14, §20.11): `{ key,
+ * commands, teardown? }` once, or `{ key, commands, recipients }` once per
+ * online recipient with `{steamid}` and `{name}` filled in by the plugin; `{
+ * key, teardownOf }` runs the teardown the plugin kept under another key
+ * (D385). `data.kind` is `command.ran` (`ran`, `rewarded`, `replies`,
+ * `skipped`, `skippedCount`, and `repeat: true` for a key the plugin has seen)
+ * or `command.error` with a reason, `unknown-command` among them.
+ */
+const commandsRun = (server, body) => request(server, '/commands/run', { method: 'POST', body })
+
 /**
  * Give back what a run owns: named ids, else everything under a key, else the
  * whole run. `data` lists `removed`, `gone` (already not there — a success)
@@ -591,6 +602,7 @@ module.exports = {
   worldCall,
   dtStart,
   gcPlace,
+  commandsRun,
   worldRevert,
   tallyOpen,
   tallySnapshot,