feat(rust): the kit weekend, linked rewards, reward messages and the kit warning (protocol 14)

PLAN_REDESIGNS §2, the Rust half (D164, D192, D332, D333):
- rust.template.kit_weekend (core registerEventTemplates, MODULE_API 1.13.0):
  inputs kit/minutes/message/delivery; one phase advance after the weekend,
  core.lease rust.group.permission default/<kit permission> + rust.kit.entitle
  linked. Steps only where the kit can use them; validated by the real core.
- rust.kit.entitle: recipients 'linked' (every linked player who has played
  on the server, no tally, refused past the bound), optional message ({kit})
  and delivery, stored per row (rust_perm_run_grants.notice*).
- perm.sync notices: the untold set to the picked account, keyed
  run:step:user, in the digest; the report's noticesTold marks them told.
- rust.options.grouppermissions notes a kit's permission rows via kits.uses
  (cached a minute per server; a failure is no note).
- duration: 'minutes' on rust.zone.open and rust.participation.open; the
  group-permission lease's value example is true.
- protocol 13 -> 14, coreApi ^1.13.0; ci/core-ref.json pinned to website#212's
  head while it is open; engagement-triggers.json regenerated (coreApi line).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/sidecarClient.js

@@ -69,7 +69,10 @@ const TIMEOUT_MS = 12000
  * `/map/render` and `/map/live`, its picture and what moves on it (PLAN.md
  * §30); **12** adds `/titles`, the chat titles BetterChat shows, and gives a
  * permission sync a group's BetterChat style and a chat line a delivery and a
- * voice (PLAN.md §33). The bump lands here in the same change as the emitters,
+ * voice (PLAN.md §33); **13** is the first player walk's fixes and redesigns and
+ * RunicNPC (PLAN_FIXES.md, PLAN_REDESIGNS.md §1–§6); **14** adds `/kits/uses`
+ * and a permission sync's `notices` — the step editor's kit warning and reward
+ * message (PLAN_REDESIGNS.md §2, D332, D333). The bump lands here in the same change as the emitters,
  * because the sidecar refuses a client declaring a different version with a
  * `409`: a module left on 2 would stop being able to read the server board it
  * has been reading all along. A constant that lags the deployment is not a safe
@@ -79,7 +82,7 @@ const TIMEOUT_MS = 12000
  * deployment into a `409` naming both numbers instead of a parse failure three
  * layers further in.
  */
-const PROTOCOL_VERSION = 13
+const PROTOCOL_VERSION = 14
 
 /** What a caller gets back. Shaped once so every call site reads the same. */
 function reply(ok, status, data = null) {
@@ -448,6 +451,15 @@ const tallyClose = (server, body) => request(server, '/tally/close', { method: '
 /** The kits this server's Kits plugin has, and the plugin's reward bounds. `kits.error` when Kits is not loaded. */
 const kits = (server) => request(server, '/kits')
 
+/**
+ * Protocol 14 (PLAN_REDESIGNS.md §2.6). Of these players, how many have used `kit`
+ * up and how many are on its cooldown: `kits.uses` with `{ kit, max, cooldown,
+ * asked, exhausted, onCooldown }`, counts only. `kits.error` when Kits is not
+ * loaded or has no such kit.
+ */
+const kitsUses = (server, kit, steamIds) =>
+  request(server, '/kits/uses', { method: 'POST', body: { kit, steamIds } })
+
 /**
  * Say one line in the server's chat. `chat.ok` carries `said: false` when the
  * key was said in the last ten minutes — a retry, answered and not repeated.
@@ -536,6 +548,7 @@ module.exports = {
   tallySnapshot,
   tallyClose,
   kits,
+  kitsUses,
   chat,
   titles,
   mapInfo,