feat: the module skeleton and every bundle seam

module-rust, id 'rust', built from the Integration Kit's template. Phase 1's job
is the kit's own argument: get every seam working at once with almost nothing in
them, so that afterwards you break exactly one at a time.

What is here:

* /rust on all three tiers, because the loader holds module.json's mounts against
  what is registered in BOTH directions -- so the declaration and the
  registration land together or not at all. The player tier is honestly thin: it
  answers the server list on the authenticated tier, delegating to the same model
  the public tier uses so the two cannot drift while they are meant to be the
  same. It is the address the app will call, registered now rather than moved
  later.
* Two tables. rust_servers is configuration an operator writes; rust_server_state
  is what a sidecar reported. Separate tables because they have different
  writers, lifetimes and audiences -- and because purging observed state while
  keeping the configuration is a thing an operator will want.
* Per-server sidecar tokens through ctx.secretBox, write-only in the API. The
  admin list reports hasToken and never the credential, and an empty token on a
  save leaves the stored one alone -- a form that posts its own blank field would
  otherwise erase a credential every time somebody renamed a server.
* A real sidecar client. It never throws: every call answers {ok, status, data},
  and the status is what tells a wrong URL from a wrong token from a mismatched
  protocol -- all three present as 'the site says my server is offline' and each
  has a different fix.
* The five guards, green: check:imports, check:swagger, check:externals, and both
  suites.

What is deliberately NOT registered: the Team provider, triggers, audiences,
engagement seeds, notification streams, the four event catalogues, and the two
extension slots. Each arrives with the phase that has something real to put in
it, and a test asserts their absence so that removing it is deliberate. A
declared trigger nothing emits and a declared slot nothing fills are both
surfaces an operator can configure and then wait on, which is worse than an
absent one because the absence is visible.

Two corrections to the kit's template, both feedback for a later phase:

* registration.test.js read one page BY NAME to check declared slots are
  rendered, so a module declaring none dies on ENOENT before reaching the loop
  that would have been empty. It now scans every file under src/routes.
* test/_fakes.js supplied validator: {}. An admin router that builds validation
  chains at file scope cannot be required with that, so the fake holds the real
  express-validator -- for the same reason it holds a real express Router.

The kit was right about noGameConnection.test.js: its header predicts that a
module adding a sidecar client will see the check go red, names sidecarClient.js
as the file to allow, and says narrow it rather than delete it. That is exactly
what happened on the first run, and the fix was the one line the header names.

Installed into a real core and verified: the module reaches 'started', publishes
its capability, serves its chunk, and renders a server whose server.hello
originated in a live Rust server.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

server/model/servers/servers.db.js

@@ -0,0 +1,137 @@
+// ── SQL, and nothing else ─────────────────────────────────────────────────
+//
+// Core's own backend is layered `router → controller → model → db`, with models
+// in pairs: a `.db.js` holding the SQL and a `.model.js` holding the logic that
+// calls it. The split earns its keep here for the same reason it does in core —
+// the file with the queries in it has no branching to test, and the file with the
+// branching in it has no database to stand up.
+//
+// Raw parameterised SQL through `core.query`, no ORM. Placeholders always.
+
+const core = require('../../core')
+
+const SERVERS = 'rust_servers'
+const STATE = 'rust_server_state'
+
+/**
+ * Every configured server, in the operator's own order.
+ *
+ * **The encrypted token comes back on this read and is never returned to a
+ * client.** Decryption happens in the model, one layer up; this file's job is to
+ * fetch a column, not to decide who may see it.
+ */
+async function listServers({ enabledOnly = false } = {}) {
+  return core.query(
+    `SELECT id, name, sidecar_base_url AS sidecarBaseUrl, sidecar_token_enc AS sidecarTokenEnc,
+            protocol, enabled, sort_order AS sortOrder, created_at AS createdAt, updated_at AS updatedAt
+       FROM ${SERVERS}
+      ${enabledOnly ? 'WHERE enabled = 1' : ''}
+      ORDER BY sort_order ASC, id ASC`,
+  )
+}
+
+async function getServer(id) {
+  const rows = await core.query(
+    `SELECT id, name, sidecar_base_url AS sidecarBaseUrl, sidecar_token_enc AS sidecarTokenEnc,
+            protocol, enabled, sort_order AS sortOrder, created_at AS createdAt, updated_at AS updatedAt
+       FROM ${SERVERS}
+      WHERE id = ?`,
+    [id],
+  )
+  return rows[0] || null
+}
+
+/**
+ * Create or replace a server row.
+ *
+ * **`sidecar_token_enc` is only written when a value is supplied.** An admin form
+ * that shows a blank token field — which is the only thing it can show, since the
+ * token is write-only — posts an empty string on every save that did not intend
+ * to change it. Writing that through would erase the credential every time an
+ * operator renamed a server, and the failure would present as the bridge going
+ * down for no reason an hour after an unrelated edit.
+ */
+async function upsertServer({ id, name, sidecarBaseUrl, sidecarTokenEnc, protocol, enabled, sortOrder }) {
+  const setToken = sidecarTokenEnc !== null && sidecarTokenEnc !== undefined
+
+  await core.query(
+    `INSERT INTO ${SERVERS}
+       (id, name, sidecar_base_url, sidecar_token_enc, protocol, enabled, sort_order, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
+     ON DUPLICATE KEY UPDATE
+       name = VALUES(name),
+       sidecar_base_url = VALUES(sidecar_base_url),
+       ${setToken ? 'sidecar_token_enc = VALUES(sidecar_token_enc),' : ''}
+       protocol = VALUES(protocol),
+       enabled = VALUES(enabled),
+       sort_order = VALUES(sort_order),
+       updated_at = CURRENT_TIMESTAMP`,
+    [id, name, sidecarBaseUrl, setToken ? sidecarTokenEnc : null, protocol, enabled ? 1 : 0, sortOrder],
+  )
+}
+
+async function deleteServer(id) {
+  await core.query(`DELETE FROM ${SERVERS} WHERE id = ?`, [id])
+}
+
+/** The last thing each server said about itself, keyed by server id. */
+async function listState() {
+  return core.query(
+    `SELECT server_id AS serverId, reachable, online, players, max_players AS maxPlayers,
+            hostname, level, seed, world_size AS worldSize, boot_id AS bootId,
+            save_created_at AS saveCreatedAt, protocol, updated_at AS updatedAt
+       FROM ${STATE}`,
+  )
+}
+
+/**
+ * Replace one server's observed state.
+ *
+ * **`updated_at` is set explicitly, and it has to be.** MariaDB's
+ * `ON UPDATE CURRENT_TIMESTAMP` fires only when an UPDATE actually CHANGES a
+ * value, so an update writing the same numbers back — exactly what a quiet
+ * server looks like — leaves the timestamp where it was. The row would then
+ * cross the freshness window and the page would report the server offline while
+ * it was up and reporting normally. That is invisible to every test and shows up
+ * as a page that was right when you looked at it and wrong an hour later.
+ */
+async function putState(state) {
+  await core.query(
+    `INSERT INTO ${STATE}
+       (server_id, reachable, online, players, max_players, hostname, level, seed,
+        world_size, boot_id, save_created_at, protocol, raw, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
+     ON DUPLICATE KEY UPDATE
+       reachable = VALUES(reachable), online = VALUES(online), players = VALUES(players),
+       max_players = VALUES(max_players), hostname = VALUES(hostname), level = VALUES(level),
+       seed = VALUES(seed), world_size = VALUES(world_size), boot_id = VALUES(boot_id),
+       save_created_at = VALUES(save_created_at), protocol = VALUES(protocol),
+       raw = VALUES(raw), updated_at = CURRENT_TIMESTAMP`,
+    [
+      state.serverId,
+      state.reachable ? 1 : 0,
+      state.online ? 1 : 0,
+      state.players || 0,
+      state.maxPlayers || 0,
+      state.hostname || null,
+      state.level || null,
+      state.seed === undefined ? null : state.seed,
+      state.worldSize === undefined ? null : state.worldSize,
+      state.bootId || null,
+      state.saveCreatedAt || null,
+      state.protocol === undefined ? null : state.protocol,
+      state.raw ? JSON.stringify(state.raw) : null,
+    ],
+  )
+}
+
+module.exports = {
+  SERVERS,
+  STATE,
+  listServers,
+  getServer,
+  upsertServer,
+  deleteServer,
+  listState,
+  putState,
+}