feat(rust): Dangerous Treasures — feed, map, Treasure Hunter, Start a Dangerous Treasures event (PLAN_REDESIGNS §14.3.4)

Stage 5 of the §14.3 integration plan, on protocol 14 (docs
rust-link/PROTOCOL.md §20.8).

- dt.started and dt.won are public kinds, dt.ended a staff kind. The new
  dangerousTreasures.js reads each row per viewer: grid and invaderCount for
  everyone, the winner's name for the presence audience (D376), the position,
  the step's key, the winner's Steam id and the invaders for staff.
- Feed lines in the World events filter: "A Dangerous Treasures event has
  started · K12", "Alice won the treasure · K12 · 3 players fought for it".
- Triggers rust.dt.started (with byEvent) and rust.dt.won, public, cooldown
  subject the server, names only.
- eventDangerousTreasures.js: rust.dt.start, "Start a Dangerous Treasures
  event" (risk change, reversible none, budget rust.dt.events), server and
  difficulty. Refused at verify where the server said DT is not loaded or
  console.plugins is false (Rust-Plugins#34). dt-not-ready answers "Dangerous
  Treasures is not ready yet" with retryAfterMs 600000 (D365, D371);
  dt-no-spot retries on core's delay; DT's own refusals are permanent.
- Treasure Hunter (D375): treasuresWon -> treasures_won, the title category
  treasureswon, and a sortable Treasures column shown where the server
  reports DT or a row counts one.
- The map draws a running chest on the world layer; the server settings'
  plugin line names DT and whether a step can start one, from the
  integrations read's new `console`.
- coreApi ^1.15.0, ci/core-ref.json pinned to website main at #215's merge.
  ci/bundle.json ships the two new files; swagger fragment and engagement
  manifest regenerated; README lists DT.

Server 627/627 (16 new in test/dangerousTreasures.test.js) and every check;
client 92/92, build and externals. Booted against the pinned core: 45
triggers, 13 actions, 11 budgets, 21 option sources; 89 routes unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/events/events.db.js

@@ -151,6 +151,8 @@ const TITLE_SUMS = {
   // Protocol 14 (D356): Safecracker and Scavenger.
   cratesHacked: 'crates_hacked',
   dropsLooted: 'drops_looted',
+  // Protocol 14 (D375): Treasure Hunter.
+  treasuresWon: 'treasures_won',
 }
 
 /** The two *best* fields and their columns: the longest single kill, never a sum. */
@@ -350,6 +352,8 @@ async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit = 25
     // Protocol 14 (D356, D377): the columns Safecracker and Scavenger bring.
     cratesHacked: 'crates_hacked',
     dropsLooted: 'drops_looted',
+    // Protocol 14 (D375): Dangerous Treasures won, Treasure Hunter's column.
+    treasuresWon: 'treasures_won',
   }[sort] || 'kills'
 
   const params = [serverId]
@@ -376,6 +380,7 @@ async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit = 25
             SUM(s.playtime_sec) AS playtimeSec,
             SUM(s.crates_hacked) AS cratesHacked,
             SUM(s.drops_looted) AS dropsLooted,
+            SUM(s.treasures_won) AS treasuresWon,
             MAX(s.balance) AS balance,
             MAX(s.last_seen) AS lastSeen
        FROM ${STATS} s

server/model/events/events.model.js

@@ -15,6 +15,7 @@
 const catalogue = require('../../catalogue')
 const worldEvents = require('../../worldEvents')
 const dynamicPvp = require('../../dynamicPvp')
+const dangerousTreasures = require('../../dangerousTreasures')
 const db = require('./events.db')
 const mapDb = require('../map/map.db')
 const serversDb = require('../servers/servers.db')
@@ -70,16 +71,22 @@ async function recent({ serverId, admin = false, staff = false, presence = false
   })
 
   const shaped = rows.map(shape)
-  if (!shaped.some((r) => r.kind === 'world.event' || dynamicPvp.KINDS.includes(r.kind))) return shaped
+  if (!shaped.some((r) => r.kind === 'world.event' || dynamicPvp.KINDS.includes(r.kind) || dangerousTreasures.isKind(r.kind))) return shaped
 
   // Protocol 14 (§14.3.1): each world event is read for THIS viewer — its type
   // allowed, its names to the presence audience, its Steam ids to staff, its
   // credit by the server's rule — and given a grid from the map's geometry.
   // Dynamic PVP's zone lines (§14.3.3) are read the same way for their grid and
-  // position. Both reads only when the page holds one of them at all.
+  // position, and Dangerous Treasures' (§14.3.4) for their grid, the winner's
+  // name and the Steam ids. Both reads only when the page holds one of them at all.
   const view = await worldView(serverId, { staff: staff || admin, presence })
   return shaped
-    .map((row) => (row.kind === 'world.event' ? worldRow(row, view) : dynamicPvp.KINDS.includes(row.kind) ? pvpRow(row, view) : row))
+    .map((row) => {
+      if (row.kind === 'world.event') return worldRow(row, view)
+      if (dynamicPvp.KINDS.includes(row.kind)) return pvpRow(row, view)
+      if (dangerousTreasures.isKind(row.kind)) return dtRow(row, view)
+      return row
+    })
     .filter(Boolean)
 }
 
@@ -104,6 +111,11 @@ function pvpRow(row, view) {
   return { ...row, frame: dynamicPvp.shapeFor(row.frame, view) }
 }
 
+/** One Dangerous Treasures row for a viewer (§14.3.4). The row's own Steam id, the winner's, is staff's. */
+function dtRow(row, view) {
+  return { ...row, steamId: view.staff ? row.steamId : null, frame: dangerousTreasures.shapeFor(row.frame, view) }
+}
+
 /** One world-event row for a viewer, or null when they may not see it. The row's own Steam id is staff's too. */
 function worldRow(row, view) {
   const frame = worldEvents.shapeFor(row.frame, view)
@@ -169,6 +181,8 @@ async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit, pre
     // Protocol 14 (D356): Safecracker's and Scavenger's counts.
     cratesHacked: Number(r.cratesHacked) || 0,
     dropsLooted: Number(r.dropsLooted) || 0,
+    // Protocol 14 (D375): Treasure Hunter's count.
+    treasuresWon: Number(r.treasuresWon) || 0,
     // Withheld below the presence audience. A tally refreshes it every minute a
     // player is on, so a `lastSeen` of forty seconds ago is the Online tab by
     // another name. The ORDER still uses it as a tie-break — that says who was