feat(rust): Teams from first-party clans (phase 9, protocol 6)

A first-party Rust clan is a Team (R5). This module becomes the site's
Team provider and answers core from the plugin's `clans` board. Design
of record: docs/modules/rust/PLAN.md §24, D47-D58.

- The store: rust_clans, rust_clan_members and rust_clan_boards. A clan's
  identity is <serverId>:<clanId>:<createdMs> (D52), because the game
  restarts clan ids whenever its clan database version changes.
- The provider (D53): getTeams is complete only when every server's
  board is fresh, supported and untruncated. It is partial when some
  are, and refuses when none are. Freshness is judged by the website's
  clock, from when the board's `t` last advanced.
- Only a complete board may mark a clan gone. A board at the game's
  100-clan ceiling (D55), or one with an unreadable row, proves nothing
  about what it leaves out.
- Leadership is diffed board to board and published (D54). The five clan
  events are published as team.* kinds, and written to the Team feed as
  members-only lines (D49).
- Core only writes feed items for a Team it already holds. So the last 10
  minutes of clan events are re-offered on each board refresh, deduped by
  a sha1 key: core clamps a dedupeKey to 40 characters, and a readable key
  would be truncated into collisions.
- projectRoster and the clan page share one audience rule (D48): the
  clan's linked members and staff by default, re-read from the users row.
  The setting lives on Admin > Rust visibility, which also warns about
  uMod Clans (D47) and the ceiling.
- Public: GET servers/:id/clans (the list is public, D58) and
  GET clans/:externalId. The client adds a Clans tab and
  /rust/clans/:externalId, with three module slots for core's notify,
  activity and forum contributions (D56).
- Linking and unlinking an account ask core to reconcile Teams (D57).
- The clan kinds are staff-class in the public feed allowlist.
- PROTOCOL_VERSION is now 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/visibility/visibility.model.js

@@ -47,6 +47,33 @@ const PRESENCE_KEY = 'presence.audience'
 
 const isAudience = (value) => RANK.has(value)
 
+// ── Who may see a clan's roster (phase 9, D48) ────────────────────────────
+//
+// The same rule applied to a roster: a roster says who is in a clan and, inside
+// its audience, which of them is on. So it defaults to the clan's OWN members
+// plus staff, and an operator widens it deliberately.
+//
+//   members     staff, and a website account linked to one of the clan's members
+//   signed_in   any active website account
+//   public      anybody
+//
+// One fleet-wide setting (D48), deliberately without a per-server override: the
+// presence override exists because a PvE server may publish a roll call a PvP one
+// must not, and a roster is the same answer on every server of the fleet.
+//
+// **Widening it widens online status too.** Core's `projectRoster` can withhold a
+// roster's rows but not its fields, so there is no rung that shows who is in a
+// clan and hides which of them is on. The admin page says so beside the switch.
+const CLAN_AUDIENCES = Object.freeze(['public', 'signed_in', 'members'])
+
+/** The narrowest rung, and the default until an operator chooses. */
+const DEFAULT_CLAN_ROSTER = 'members'
+
+/** The `rust_settings` key the roster audience lives under. */
+const CLAN_ROSTER_KEY = 'clans.roster.audience'
+
+const isClanAudience = (value) => CLAN_AUDIENCES.includes(value)
+
 const viewerRank = (level) => RANK.get(level) ?? 0
 const requiredRank = (level) => RANK.get(level) ?? RANK.get('staff')
 
@@ -124,11 +151,26 @@ async function canSeePresence(req, serverId) {
   }
 }
 
+/**
+ * The clan roster audience. An unrecognised stored word narrows to `members`,
+ * and a read that fails throws — every caller answers "no" on a throw, which is
+ * the direction a roster must fail in.
+ */
+async function clanRosterAudience() {
+  const stored = await db.getSetting(CLAN_ROSTER_KEY)
+  return isClanAudience(stored) ? stored : DEFAULT_CLAN_ROSTER
+}
+
 /** The admin screen's read: the fleet default and every server beside it. */
 async function describe() {
-  const [fleet, servers] = await Promise.all([fleetPresence(), db.listServerPresence()])
+  const [fleet, servers, clanRoster] = await Promise.all([
+    fleetPresence(),
+    db.listServerPresence(),
+    clanRosterAudience(),
+  ])
   return {
     audiences: [...AUDIENCES],
+    clans: { audiences: [...CLAN_AUDIENCES], roster: clanRoster },
     presence: {
       fleet,
       servers: servers.map((s) => {
@@ -155,11 +197,19 @@ async function describe() {
  * Resolves `{ ok, changed }`, or `{ ok: false, status, message }` — a refusal is a
  * sentence the page can show.
  */
-async function update({ fleet, servers } = {}, actor = null) {
+async function update({ fleet, servers, clanRoster } = {}, actor = null) {
   if (fleet !== undefined && !isAudience(fleet)) {
     return { ok: false, status: 400, message: `"${fleet}" is not an audience. Choose one of: ${AUDIENCES.join(', ')}.` }
   }
 
+  if (clanRoster !== undefined && !isClanAudience(clanRoster)) {
+    return {
+      ok: false,
+      status: 400,
+      message: `"${clanRoster}" is not a clan roster audience. Choose one of: ${CLAN_AUDIENCES.join(', ')}.`,
+    }
+  }
+
   const changes = Object.entries(servers || {})
   for (const [id, value] of changes) {
     if (value !== null && !isAudience(value)) {
@@ -174,6 +224,7 @@ async function update({ fleet, servers } = {}, actor = null) {
   const userId = actor && actor.id != null ? actor.id : null
 
   if (fleet !== undefined) await db.setSetting(PRESENCE_KEY, fleet, userId)
+  if (clanRoster !== undefined) await db.setSetting(CLAN_ROSTER_KEY, clanRoster, userId)
   for (const [id, value] of changes) {
     // eslint-disable-next-line no-await-in-loop
     await db.setServerPresence(id, value)
@@ -186,6 +237,7 @@ async function update({ fleet, servers } = {}, actor = null) {
     ok: true,
     changed: {
       ...(fleet !== undefined ? { fleet } : {}),
+      ...(clanRoster !== undefined ? { clanRoster } : {}),
       servers: Object.fromEntries(changes.map(([id, value]) => [id, value === null ? 'inherit' : value])),
     },
   }
@@ -196,6 +248,11 @@ module.exports = {
   DEFAULT_PRESENCE,
   PRESENCE_KEY,
   isAudience,
+  CLAN_AUDIENCES,
+  DEFAULT_CLAN_ROSTER,
+  CLAN_ROSTER_KEY,
+  isClanAudience,
+  clanRosterAudience,
   meets,
   normalise,
   viewerLevel,