feat(rust): Economics — pay coins, balances, staff adjust, the richest (PLAN_REDESIGNS §11.2)

The site half of §11.2.2, on protocol 14:

- `rust.coins.pay` ("Pay coins"): irreversible, reversible none (D335). The
  recipient modes of rust.kit.entitle including `linked`, one payment per
  website user (D103's rule), an optional message with {amount}, a new
  `rust.coins` budget. Refused with "Economics is not installed on this
  server" in the dry run too (D199). Core's key goes to the plugin, so a
  retried step answers `repeat` and pays nobody twice.
- `rust_player_wipe_stats.balance`: the tally's balance, written as a value.
  A nameless balance frame (an offline player) moves nobody's last-seen.
  `economics.wiped` clears the wipe's balances, except at a new save.
- The richest: a Coins leaderboard column on one wipe of a server that
  reports Economics, `sort=balance`, and a `richest` title category
  (Magnate); both rank only above the starting balance (D336).
- GET /player/rust/economics (live, falling back to the last known), and
  GET/POST /admin/users/:id/rust/economics for staff — scoped to the user's
  own links, keyed per submission, an activity row with before and after.
- Client: the account page's Coins, the admin user page's Coins panel with
  its form, the leaderboard column, and Economics in the server's mod line
  (saying when its config could not be read).

Server 535/535 (14 new in test/economics.test.js), client 74/74,
routes.manifest regenerated against the pinned core (87 routes), swagger
fragment regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/router/player/rust.controller.js

@@ -21,6 +21,7 @@
 
 const core = require('../../core')
 
+const economics = require('../../model/economics/economics.model')
 const links = require('../../model/links/links.model')
 const npcs = require('../../model/npcs/npcs.model')
 const npcsDb = require('../../model/npcs/npcs.db')
@@ -55,6 +56,20 @@ async function ownNpcKills(req, res) {
   }
 }
 
+/**
+ * GET /player/rust/economics — the caller's coin balances (§11.2.2): every
+ * server, each linked account, live where the server answers.
+ */
+async function ownEconomics(req, res) {
+  try {
+    const held = await links.listForUser(req.user.id)
+    res.json({ servers: await economics.balancesOf(held.map((l) => ({ steamId: l.steamId, name: l.name }))) })
+  } catch (err) {
+    log.error('failed to read a player’s balances', { error: err.message })
+    res.status(500).json({ message: 'Failed to read your balances' })
+  }
+}
+
 /** GET /player/rust/links — the Steam accounts the caller holds. */
 async function listLinks(req, res) {
   try {
@@ -187,4 +202,4 @@ async function listPermissions(req, res) {
   }
 }
 
-module.exports = { listServers, listLinks, confirmLink, removeLink, listPermissions, ownNpcKills }
+module.exports = { listServers, listLinks, confirmLink, removeLink, listPermissions, ownNpcKills, ownEconomics }

server/router/player/rust.router.js

@@ -67,6 +67,16 @@ playerRustRouter.get(
   rust.ownNpcKills,
 )
 
+playerRustRouter.get(
+  '/economics',
+  // #swagger.tags = ['Player · Rust']
+  // #swagger.summary = 'Your coin balances'
+  // #swagger.description = 'The caller’s Economics balance on every server, per linked Steam account (PLAN_REDESIGNS §11.2.2). Read live from each server; where a server does not answer, the last balance it reported (`source: last-known`), and null where neither knows. A server without Economics is listed with `economics: false` and the reason. `startingKnown: false` means the server’s Economics config could not be read and the starting balance shown is Economics’ default. Empty `accounts` with no linked account. Requires a session.'
+  // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
+  /* #swagger.responses[200] = { description: 'The balances', content: { "application/json": { schema: { $ref: "#/components/schemas/RustEconomicsBalances" } } } } */
+  rust.ownEconomics,
+)
+
 playerRustRouter.get(
   '/servers',
   // #swagger.tags = ['Player · Rust']