feat(rust): the world verbs, their budgets and the reconcile watch (phase 13a, protocol 9)

- registerEventActions: rust.zone.open and rust.prefab.place, both
  reversible 'ledger' with revert() and reconcile(), budgetMs 15000 above the
  client's 12 s. A location is a monument (kind + instance, carrying its
  server) or raw coordinates, exactly one (D87, D93); bounds mirrored from the
  plugin so a bad step is refused on the form (D95); zone minutes required and
  held by the game (D96).
- registerEventBudgets: rust.prefabs, rust.npcs and rust.zone.minutes, each
  beside the verb that spends it (D79, D89).
- Option sources rust.options.monuments (live, searchable) and
  rust.options.prefabs (mirrored, answers with every server off), registered in
  the one batch core accepts alongside the lease sources.
- Refs are <serverId>:<id>, since revert and reconcile get no params. The undo
  sends no idempotency key; a lost answer is reverted by key on every server.
  reconcile asks the plugin, and a server that cannot be asked keeps its rows.
- The refresh's bootId/wipeId watch calls ctx.events.reconcile() on a restart
  or a wipe, never on a first sighting or a reconnect (§11.1).
- The permission mirror keeps the plugin's new notLanded grants out of what it
  records as pushed, and the admin page says so (D85).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

client/src/routes/admin/Permissions.jsx

@@ -97,6 +97,7 @@ function ServerState({ row, onSync, busy }) {
   const report = row.report || {}
   const unresolved = report.unresolved || []
   const pending = report.pending || []
+  const notLanded = report.notLanded || []
 
   return (
     <div style={{ padding: '10px 0', borderTop: '1px solid var(--line-soft)' }}>
@@ -141,6 +142,15 @@ function ServerState({ row, onSync, busy }) {
           in a group yet.
         </Warn>
       )}
+
+      {notLanded.length > 0 && (
+        <Warn>
+          {notLanded.length} {notLanded.length === 1 ? 'grant was' : 'grants were'} sent and not found
+          in the game's permission store afterwards ({notLanded.slice(0, 5).join(', ')}
+          {notLanded.length > 5 ? ', …' : ''}). They are not counted as pushed, and the next sync
+          tries again.
+        </Warn>
+      )}
     </div>
   )
 }