feat(rust): a Steam account linked on the site is a Rust link (D392, D396)

Registers core's MODULE_API 1.17.0 identity hooks (coreApi ^1.17.0):
onIdentityLinking refuses a Steam id that is another website account's Rust
link (D396); onIdentityLinked writes the Rust link with the PRIMARY KEY as the
race guard, reconciles Teams and raises the linked notice, as /link does.
Unlinking Steam leaves the Rust link (D393); the Rust account page says so.

ci/core-ref.json still pins the 1.15.0 core and must move to the website
branch head carrying 1.17.0 before CI can pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

client/src/routes/player/Account.jsx

@@ -377,6 +377,15 @@ export default function Account() {
         <li>Type it below. It works once.</li>
       </ol>
 
+      {/* D392: core's "Link Steam" is a second way to make this link. Unlinking
+          Steam there removes only the sign-in (D393), so this page says where a
+          Rust link is removed. */}
+      <p className="sans dim" style={{ margin: '10px 0 0', fontSize: '0.86rem', maxWidth: '60ch' }}>
+        If this site offers Steam sign-in, linking Steam on your <a href="/account" className="link-accent">account
+        page</a> links that Steam account here too. Unlinking it there only stops you signing in with it; remove a
+        Rust link here.
+      </p>
+
       <LinkForm onLinked={reload} />
 
       {loading && <Loading />}