feat(safety): report, block and hide chat lines (MODULE_API 1.21.0)

USER_SAFETY.md step 3, the module half of report, block and hide.

- server/safety.js registers the rust.chat report target (snapshot for one
  reader, null when they could not have seen the line; staff's hide and
  unhide) and the steam game identity (ownersOf from rust_account_links).
- The events feed filters chat per reader, in the query: lines from a
  blocked account's Steam ids, the reader's unlinked Steam-ID blocks and the
  lines they hid. Signed-in readers get canBlock on each chat line (false for
  their own and for staff-linked players). Lines staff hid for everyone are
  left out for everyone but staff, who get them with hidden: true.
- rust_events gains hidden_at and hidden_by (ALTER ... IF NOT EXISTS).
- POST /admin/rust/chat/:id/hide and /unhide (admin, moderator), logged.
- The feed's chat lines get a menu: Report, Hide for me, Block player,
  and for staff Hide for everyone / Show to everyone again.
- coreApi ^1.21.0; ci/core-ref.json pinned to the website#233 merge;
  routes.manifest.json and swagger-fragment.json regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/index.js

@@ -175,6 +175,16 @@ module.exports = function register(ctx, api) {
   // deletion, and never waits on a game.
   api.onUserDeleting(links.unlinkForDeletion)
 
+  // Report, block and hide (MODULE_API 1.21.0; USER_SAFETY.md §4.2). A chat line
+  // is a `rust.chat` report target: core files the report and keeps the queue,
+  // and asks this module what a line is, for one reader, and to hide it for
+  // everyone. A speaker is known by their Steam id, and `steam` says which
+  // website account one is linked to, so a block lands on the account first
+  // (S12). The feed's own filtering and `canBlock` are in the events route.
+  const safety = require('./safety') // eslint-disable-line global-require
+  api.registerReportTargets(safety.REPORT_TARGETS)
+  api.registerGameIdentities(safety.GAME_IDENTITIES)
+
   // The public demo's seed (MODULE_API 1.18.0, DM15): the rig's server row and
   // demo-player's Steam link, written by this module from its part of the
   // fixture. Called only by `npm run seed:demo` on a DEMO_MODE deployment. The
@@ -255,6 +265,7 @@ module.exports = function register(ctx, api) {
     budgets: eventWorld.BUDGETS.length + eventRewards.BUDGETS.length + eventPermRewards.BUDGETS.length + eventWorldCall.BUDGETS.length + eventDangerousTreasures.BUDGETS.length + eventGuardedCrate.BUDGETS.length + eventCommands.BUDGETS.length + eventRaidableBases.BUDGETS.length,
     announceLeg: eventRewards.LEG.leg,
     commands: commands.map((cmd) => cmd.name).join(' '),
+    reportTargets: safety.REPORT_TARGETS.map((t) => t.id).join(' '),
     optionSources: eventLeases.OPTION_SOURCES.length + eventWorld.OPTION_SOURCES.length + eventRewards.OPTION_SOURCES.length + eventPermRewards.OPTION_SOURCES.length + eventWorldCall.OPTION_SOURCES.length + eventDangerousTreasures.OPTION_SOURCES.length + eventGuardedCrate.OPTION_SOURCES.length + eventRaidableBases.OPTION_SOURCES.length,
   })
 }