feat(safety): report, block and hide chat lines (MODULE_API 1.21.0)

USER_SAFETY.md step 3, the module half of report, block and hide.

- server/safety.js registers the rust.chat report target (snapshot for one
  reader, null when they could not have seen the line; staff's hide and
  unhide) and the steam game identity (ownersOf from rust_account_links).
- The events feed filters chat per reader, in the query: lines from a
  blocked account's Steam ids, the reader's unlinked Steam-ID blocks and the
  lines they hid. Signed-in readers get canBlock on each chat line (false for
  their own and for staff-linked players). Lines staff hid for everyone are
  left out for everyone but staff, who get them with hidden: true.
- rust_events gains hidden_at and hidden_by (ALTER ... IF NOT EXISTS).
- POST /admin/rust/chat/:id/hide and /unhide (admin, moderator), logged.
- The feed's chat lines get a menu: Report, Hide for me, Block player,
  and for staff Hide for everyone / Show to everyone again.
- coreApi ^1.21.0; ci/core-ref.json pinned to the website#233 merge;
  routes.manifest.json and swagger-fragment.json regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/links/links.db.js

@@ -166,6 +166,18 @@ async function userIdsForSteamIds(steamIds) {
   )
 }
 
+/**
+ * The other direction: every Steam id these website accounts hold. A chat line
+ * is filed under a Steam id, so a block on an account (USER_SAFETY.md S12) hides
+ * the lines of every Steam id that account links.
+ */
+async function steamIdsForUsers(userIds) {
+  if (!userIds.length) return []
+  const marks = userIds.map(() => '?').join(', ')
+  const rows = await core.query(`SELECT steam_id AS steamId FROM ${LINKS} WHERE user_id IN (${marks})`, userIds)
+  return rows.map((r) => String(r.steamId))
+}
+
 /**
  * The linked players of one server: every linked Steam account that has played
  * there, in any wipe (PLAN_REDESIGNS.md §2.5, the kit weekend's `linked`).
@@ -217,5 +229,6 @@ module.exports = {
   removeBySteamId,
   statsForSteamId,
   userIdsForSteamIds,
+  steamIdsForUsers,
   linkedOnServer,
 }