feat(rust): Guarded Crate — feed, map, Warden, Place a guarded crate (PLAN_REDESIGNS §14.3.5)

Stage 6 of the §14.3 integration plan, on protocol 14. Spec: docs
rust-link/PROTOCOL.md §20.9.

- gc.started and gc.ended public, gc.failed staff's; guardedCrate.js reads
  each row per viewer (the clearer's name for the presence audience, Steam id,
  position and key for staff, `won` for everyone).
- Triggers rust.gc.started and rust.gc.ended (a crate a player cleared only).
- The step rust.gc.place: an event from rust.options.gc_events and a world
  call's location; refused at verify for Guarded Crate absent, NpcSpawn missing
  (D364), console unavailable, or an unknown event. Kept (D373); the run log's
  success line says so (D380). Budget rust.gc.crates.
- Warden (D375): guarded_won, title category guardedwon, Crates cleared column.
- Map marker, server settings line, swagger, engagement manifest, bundle, README.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/events/events.db.js

@@ -153,6 +153,8 @@ const TITLE_SUMS = {
   dropsLooted: 'drops_looted',
   // Protocol 14 (D375): Treasure Hunter.
   treasuresWon: 'treasures_won',
+  // Protocol 14 (D375): Warden.
+  guardedWon: 'guarded_won',
 }
 
 /** The two *best* fields and their columns: the longest single kill, never a sum. */
@@ -354,6 +356,8 @@ async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit = 25
     dropsLooted: 'drops_looted',
     // Protocol 14 (D375): Dangerous Treasures won, Treasure Hunter's column.
     treasuresWon: 'treasures_won',
+    // Protocol 14 (D375): guarded crates cleared, Warden's column.
+    guardedWon: 'guarded_won',
   }[sort] || 'kills'
 
   const params = [serverId]
@@ -381,6 +385,7 @@ async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit = 25
             SUM(s.crates_hacked) AS cratesHacked,
             SUM(s.drops_looted) AS dropsLooted,
             SUM(s.treasures_won) AS treasuresWon,
+            SUM(s.guarded_won) AS guardedWon,
             MAX(s.balance) AS balance,
             MAX(s.last_seen) AS lastSeen
        FROM ${STATS} s

server/model/events/events.model.js

@@ -16,6 +16,7 @@ const catalogue = require('../../catalogue')
 const worldEvents = require('../../worldEvents')
 const dynamicPvp = require('../../dynamicPvp')
 const dangerousTreasures = require('../../dangerousTreasures')
+const guardedCrate = require('../../guardedCrate')
 const db = require('./events.db')
 const mapDb = require('../map/map.db')
 const serversDb = require('../servers/servers.db')
@@ -71,20 +72,22 @@ async function recent({ serverId, admin = false, staff = false, presence = false
   })
 
   const shaped = rows.map(shape)
-  if (!shaped.some((r) => r.kind === 'world.event' || dynamicPvp.KINDS.includes(r.kind) || dangerousTreasures.isKind(r.kind))) return shaped
+  if (!shaped.some((r) => r.kind === 'world.event' || dynamicPvp.KINDS.includes(r.kind) || dangerousTreasures.isKind(r.kind) || guardedCrate.isKind(r.kind))) return shaped
 
   // Protocol 14 (§14.3.1): each world event is read for THIS viewer — its type
   // allowed, its names to the presence audience, its Steam ids to staff, its
   // credit by the server's rule — and given a grid from the map's geometry.
   // Dynamic PVP's zone lines (§14.3.3) are read the same way for their grid and
   // position, and Dangerous Treasures' (§14.3.4) for their grid, the winner's
-  // name and the Steam ids. Both reads only when the page holds one of them at all.
+  // name and the Steam ids, and Guarded Crate's (§14.3.5) alike. Both reads only
+  // when the page holds one of them at all.
   const view = await worldView(serverId, { staff: staff || admin, presence })
   return shaped
     .map((row) => {
       if (row.kind === 'world.event') return worldRow(row, view)
       if (dynamicPvp.KINDS.includes(row.kind)) return pvpRow(row, view)
       if (dangerousTreasures.isKind(row.kind)) return dtRow(row, view)
+      if (guardedCrate.isKind(row.kind)) return gcRow(row, view)
       return row
     })
     .filter(Boolean)
@@ -116,6 +119,11 @@ function dtRow(row, view) {
   return { ...row, steamId: view.staff ? row.steamId : null, frame: dangerousTreasures.shapeFor(row.frame, view) }
 }
 
+/** One Guarded Crate row for a viewer (§14.3.5). The row's own Steam id, the clearer's, is staff's. */
+function gcRow(row, view) {
+  return { ...row, steamId: view.staff ? row.steamId : null, frame: guardedCrate.shapeFor(row.frame, view) }
+}
+
 /** One world-event row for a viewer, or null when they may not see it. The row's own Steam id is staff's too. */
 function worldRow(row, view) {
   const frame = worldEvents.shapeFor(row.frame, view)
@@ -183,6 +191,8 @@ async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit, pre
     dropsLooted: Number(r.dropsLooted) || 0,
     // Protocol 14 (D375): Treasure Hunter's count.
     treasuresWon: Number(r.treasuresWon) || 0,
+    // Protocol 14 (D375): Warden's count.
+    guardedWon: Number(r.guardedWon) || 0,
     // Withheld below the presence audience. A tally refreshes it every minute a
     // player is on, so a `lastSeen` of forty seconds ago is the Online tab by
     // another name. The ORDER still uses it as a tie-break — that says who was