feat(rust): the kit weekend, linked rewards, reward messages and the kit warning (protocol 14)

PLAN_REDESIGNS §2, the Rust half (D164, D192, D332, D333):
- rust.template.kit_weekend (core registerEventTemplates, MODULE_API 1.13.0):
  inputs kit/minutes/message/delivery; one phase advance after the weekend,
  core.lease rust.group.permission default/<kit permission> + rust.kit.entitle
  linked. Steps only where the kit can use them; validated by the real core.
- rust.kit.entitle: recipients 'linked' (every linked player who has played
  on the server, no tally, refused past the bound), optional message ({kit})
  and delivery, stored per row (rust_perm_run_grants.notice*).
- perm.sync notices: the untold set to the picked account, keyed
  run:step:user, in the digest; the report's noticesTold marks them told.
- rust.options.grouppermissions notes a kit's permission rows via kits.uses
  (cached a minute per server; a failure is no note).
- duration: 'minutes' on rust.zone.open and rust.participation.open; the
  group-permission lease's value example is true.
- protocol 13 -> 14, coreApi ^1.13.0; ci/core-ref.json pinned to website#212's
  head while it is open; engagement-triggers.json regenerated (coreApi line).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/links/links.db.js

@@ -166,6 +166,28 @@ async function userIdsForSteamIds(steamIds) {
   )
 }
 
+/**
+ * The linked players of one server: every linked Steam account that has played
+ * there, in any wipe (PLAN_REDESIGNS.md §2.5, the kit weekend's `linked`).
+ *
+ * "Has played there" is a stats row on that server, which every player who ever
+ * connected has. A link is fleet-wide, so the server is what narrows it: a kit
+ * weekend on one server rewards that server's players, not every account on the
+ * site. Bounded at `limit`, ordered by most recently seen, so a caller with a
+ * cap keeps the people who are actually around.
+ */
+async function linkedOnServer(serverId, limit = 5000) {
+  return core.query(
+    `SELECT l.steam_id AS steamId, l.user_id AS userId, l.name AS name, MAX(s.last_seen) AS lastSeen
+       FROM ${LINKS} l
+       JOIN rust_player_wipe_stats s ON s.steam_id = l.steam_id AND s.server_id = ?
+      GROUP BY l.steam_id, l.user_id, l.name
+      ORDER BY lastSeen DESC, l.steam_id
+      LIMIT ?`,
+    [serverId, Number(limit) || 5000],
+  )
+}
+
 /**
  * The servers that handed out a link code in the last `windowSec` (PLAN_FIXES F5).
  *
@@ -195,4 +217,5 @@ module.exports = {
   removeBySteamId,
   statsForSteamId,
   userIdsForSteamIds,
+  linkedOnServer,
 }