feat(rust): Teams from first-party clans (phase 9, protocol 6)

A first-party Rust clan is a Team (R5). This module becomes the site's
Team provider and answers core from the plugin's `clans` board. Design
of record: docs/modules/rust/PLAN.md §24, D47-D58.

- The store: rust_clans, rust_clan_members and rust_clan_boards. A clan's
  identity is <serverId>:<clanId>:<createdMs> (D52), because the game
  restarts clan ids whenever its clan database version changes.
- The provider (D53): getTeams is complete only when every server's
  board is fresh, supported and untruncated. It is partial when some
  are, and refuses when none are. Freshness is judged by the website's
  clock, from when the board's `t` last advanced.
- Only a complete board may mark a clan gone. A board at the game's
  100-clan ceiling (D55), or one with an unreadable row, proves nothing
  about what it leaves out.
- Leadership is diffed board to board and published (D54). The five clan
  events are published as team.* kinds, and written to the Team feed as
  members-only lines (D49).
- Core only writes feed items for a Team it already holds. So the last 10
  minutes of clan events are re-offered on each board refresh, deduped by
  a sha1 key: core clamps a dedupeKey to 40 characters, and a readable key
  would be truncated into collisions.
- projectRoster and the clan page share one audience rule (D48): the
  clan's linked members and staff by default, re-read from the users row.
  The setting lives on Admin > Rust visibility, which also warns about
  uMod Clans (D47) and the ceiling.
- Public: GET servers/:id/clans (the list is public, D58) and
  GET clans/:externalId. The client adds a Clans tab and
  /rust/clans/:externalId, with three module slots for core's notify,
  activity and forum contributions (D56).
- Linking and unlinking an account ask core to reconcile Teams (D57).
- The clan kinds are staff-class in the public feed allowlist.
- PROTOCOL_VERSION is now 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

README.md

@@ -40,11 +40,15 @@ rows here; the website core never learns there is more than one.
 | Public | `GET …/servers/:id/events` — the feed, served from a default-deny allowlist (`server/catalogue.js`) |
 | Public | `GET …/servers/:id/leaderboard` — per wipe, or all-time as those rows summed |
 | Public | `GET …/servers/:id/wipes` and `…/online` |
+| Public | `GET …/servers/:id/clans` — the server's clans, best score first (public: names nobody) |
+| Public | `GET /api/v1/public/rust/clans/:externalId` — one clan, and its roster inside the roster audience |
 | Player | `GET /api/v1/player/rust/servers` — the server list, on the authenticated tier |
 | Admin | `GET/PUT/DELETE /api/v1/admin/rust/servers` and `POST …/:id/test` |
 | Admin | `GET/PUT /api/v1/admin/rust/visibility` — who may see who is online, fleet-wide and per server |
 | Pages | `/rust` — the server list, and the module's landing page |
-| Pages | `/rust/servers/:id` — one server: feed, leaderboard, who is on, wipes |
+| Pages | `/rust/servers/:id` — one server: feed, leaderboard, who is on, wipes, clans |
+| Pages | `/rust/clans/:externalId` — one clan, with core's Team notify, activity and forum in three module slots |
+| Teams | The deployment's Team provider: a first-party Rust clan is a Team |
 | Slot | `site.footer.status` — a live server/player count in core's footer |
 
 **Nothing names who is online by default.** The Online list, every feed item that says a named
@@ -62,7 +66,14 @@ Seven tables: `rust_servers` (configuration), `rust_server_state` and `rust_pres
 state), `rust_wipes`, `rust_players`, `rust_player_wipe_stats` and `rust_gather_totals` (the record a
 wipe does not erase), plus the bounded `rust_events` window and the `rust_ingest_cursor`.
 
-The rest of the module — identity, site-owned permissions, Teams from Rust's clans, notifications,
+**Teams come from Rust's own clans**, not from the uMod Clans plugin, which is optional and whose
+clans never become Teams. A clan's roster reaches its own members and staff unless an operator
+widens it in Admin → Rust visibility; its name, colour, score and count are public. The game lists
+at most 100 clans per server, and a server at that ceiling answers core partially, so core never
+removes a Team on its word. Core holds one Team provider per site, which is one reason **a site runs
+one module**: core's installer refuses a second.
+
+The rest of the module — notifications,
 events, the live map, Discord commands — arrives phase by phase. **Nothing is registered before it
 has something behind it:** a declared trigger nothing emits and a declared slot nothing fills are
 both surfaces an operator can configure and then wait on, which is worse than an absent one.