feat(safety): report, block and hide chat lines (MODULE_API 1.21.0)

USER_SAFETY.md step 3, the module half of report, block and hide.

- server/safety.js registers the rust.chat report target (snapshot for one
  reader, null when they could not have seen the line; staff's hide and
  unhide) and the steam game identity (ownersOf from rust_account_links).
- The events feed filters chat per reader, in the query: lines from a
  blocked account's Steam ids, the reader's unlinked Steam-ID blocks and the
  lines they hid. Signed-in readers get canBlock on each chat line (false for
  their own and for staff-linked players). Lines staff hid for everyone are
  left out for everyone but staff, who get them with hidden: true.
- rust_events gains hidden_at and hidden_by (ALTER ... IF NOT EXISTS).
- POST /admin/rust/chat/:id/hide and /unhide (admin, moderator), logged.
- The feed's chat lines get a menu: Report, Hide for me, Block player,
  and for staff Hide for everyone / Show to everyone again.
- coreApi ^1.21.0; ci/core-ref.json pinned to the website#233 merge;
  routes.manifest.json and swagger-fragment.json regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/router/admin/rust.controller.js

@@ -13,6 +13,7 @@
 const core = require('../../core')
 
 const db = require('../../model/servers/servers.db')
+const eventsDb = require('../../model/events/events.db')
 const mapImages = require('../../mapImages')
 const nextWipe = require('../../model/servers/nextWipe')
 const servers = require('../../model/servers/servers.model')
@@ -379,7 +380,40 @@ async function putVoice(req, res) {
   }
 }
 
+/**
+ * Staff's hide for everyone on one chat line, and its undo, from the line's own
+ * menu in the feed (USER_SAFETY.md §1, S10). Core's Reports queue hides through
+ * `safety.js`'s registered `hide`; this is the same flag set where the line
+ * lives, and the only place it is cleared, since staff still see a hidden line
+ * there, marked.
+ */
+function chatHidden(hidden) {
+  return async function setChatHidden(req, res) {
+    const id = Number(req.params.id)
+    try {
+      const line = await eventsDb.chatLineById(id)
+      if (!line) return res.status(404).json({ message: 'No such chat line' })
+
+      await eventsDb.setChatHidden(id, hidden, req.user ? req.user.id : null)
+      await core.activity.log({
+        req,
+        action: hidden ? 'rust.chat.hide' : 'rust.chat.unhide',
+        detail: { line: id, server: line.serverId, steamId: line.steamId || null },
+      })
+      return res.status(204).end()
+    } catch (err) {
+      log.error('failed to change a chat line', { line: id, hidden, error: err.message })
+      return res.status(500).json({ message: hidden ? 'Failed to hide the line' : 'Failed to show the line again' })
+    }
+  }
+}
+
+const hideChat = chatHidden(true)
+const unhideChat = chatHidden(false)
+
 module.exports = {
+  hideChat,
+  unhideChat,
   scheduleFrom,
   listServers,
   putServer,