feat(rust): the kit weekend, linked rewards, reward messages and the kit warning (protocol 14)

PLAN_REDESIGNS §2, the Rust half (D164, D192, D332, D333):
- rust.template.kit_weekend (core registerEventTemplates, MODULE_API 1.13.0):
  inputs kit/minutes/message/delivery; one phase advance after the weekend,
  core.lease rust.group.permission default/<kit permission> + rust.kit.entitle
  linked. Steps only where the kit can use them; validated by the real core.
- rust.kit.entitle: recipients 'linked' (every linked player who has played
  on the server, no tally, refused past the bound), optional message ({kit})
  and delivery, stored per row (rust_perm_run_grants.notice*).
- perm.sync notices: the untold set to the picked account, keyed
  run:step:user, in the digest; the report's noticesTold marks them told.
- rust.options.grouppermissions notes a kit's permission rows via kits.uses
  (cached a minute per server; a failure is no note).
- duration: 'minutes' on rust.zone.open and rust.participation.open; the
  group-permission lease's value example is true.
- protocol 13 -> 14, coreApi ^1.13.0; ci/core-ref.json pinned to website#212's
  head while it is open; engagement-triggers.json regenerated (coreApi line).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/permissions/permissions.db.js

@@ -398,7 +398,8 @@ async function deleteExceptionsFor(holder, grantId) {
 async function listRunGrants() {
   return core.query(
     `SELECT run_id AS runId, step_id AS stepId, user_id AS userId, server_id AS serverId,
-            steam_id AS steamId, permission, kit, credit
+            steam_id AS steamId, permission, kit, credit,
+            notice, notice_delivery AS noticeDelivery, notice_told_at AS noticeToldAt
        FROM ${RUN_GRANTS}`,
   )
 }
@@ -416,8 +417,8 @@ async function insertRunGrants(rows) {
   if (!rows.length) return 0
 
   const result = await core.query(
-    `INSERT IGNORE INTO ${RUN_GRANTS} (run_id, step_id, idem_key, user_id, server_id, steam_id, permission, kit, credit)
-          VALUES ${placeholders(rows, 9)}`,
+    `INSERT IGNORE INTO ${RUN_GRANTS} (run_id, step_id, idem_key, user_id, server_id, steam_id, permission, kit, credit, notice, notice_delivery)
+          VALUES ${placeholders(rows, 11)}`,
     rows.flatMap((r) => [
       String(r.runId),
       String(r.stepId),
@@ -428,12 +429,36 @@ async function insertRunGrants(rows) {
       r.permission || '',
       r.kit,
       r.credit ? 1 : 0,
+      r.notice || null,
+      r.notice ? r.noticeDelivery || 'chat' : null,
     ]),
   )
 
   return affected(result)
 }
 
+/**
+ * Mark reward messages told (protocol 14, D333): the plugin listed their keys in
+ * a sync report. A key is `<runId>:<stepId>:<userId>` (`noticeKey` in the
+ * model); one that names no untold row — told already, or withdrawn — changes
+ * nothing.
+ */
+async function markNoticesTold(serverId, keys) {
+  let marked = 0
+  for (const key of keys || []) {
+    const [runId, stepId, userId] = String(key).split(':')
+    if (!runId || !stepId || !Number(userId)) continue
+    const result = await core.query(
+      `UPDATE ${RUN_GRANTS} SET notice_told_at = NOW()
+        WHERE server_id = ? AND run_id = ? AND step_id = ? AND user_id = ?
+          AND notice IS NOT NULL AND notice_told_at IS NULL`,
+      [serverId, runId, stepId, Number(userId)],
+    )
+    marked += affected(result)
+  }
+  return marked
+}
+
 async function deleteRunGrantsForStep(runId, stepId) {
   return deleteRunGrantsWhere('run_id = ? AND step_id = ?', [String(runId), String(stepId)])
 }
@@ -858,6 +883,7 @@ module.exports = {
   deleteException,
   deleteExceptionsFor,
   listRunGrants,
+  markNoticesTold,
   listRunGrantsForStep,
   insertRunGrants,
   deleteRunGrantsForStep,