feat(safety): report, block and hide chat lines (MODULE_API 1.21.0)

USER_SAFETY.md step 3, the module half of report, block and hide.

- server/safety.js registers the rust.chat report target (snapshot for one
  reader, null when they could not have seen the line; staff's hide and
  unhide) and the steam game identity (ownersOf from rust_account_links).
- The events feed filters chat per reader, in the query: lines from a
  blocked account's Steam ids, the reader's unlinked Steam-ID blocks and the
  lines they hid. Signed-in readers get canBlock on each chat line (false for
  their own and for staff-linked players). Lines staff hid for everyone are
  left out for everyone but staff, who get them with hidden: true.
- rust_events gains hidden_at and hidden_by (ALTER ... IF NOT EXISTS).
- POST /admin/rust/chat/:id/hide and /unhide (admin, moderator), logged.
- The feed's chat lines get a menu: Report, Hide for me, Block player,
  and for staff Hide for everyone / Show to everyone again.
- coreApi ^1.21.0; ci/core-ref.json pinned to the website#233 merge;
  routes.manifest.json and swagger-fragment.json regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/router/admin/rust.router.js

@@ -123,6 +123,39 @@ adminRustRouter.post(
   admin.testServer,
 )
 
+// ── Hide a chat line for everyone (USER_SAFETY.md §1, S10) ────────────────
+//
+// From the line's own menu in the feed. `admin` and `moderator`, the two roles
+// core's Reports queue is open to — an editor writes content and moderates none.
+
+adminRustRouter.post(
+  '/chat/:id/hide',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Hide a chat line for everyone'
+  // #swagger.description = 'Staff’s hide for everyone (USER_SAFETY.md S10): the line leaves the public feed for everybody but staff, who still get it with `hidden: true`. The same flag core’s Reports queue sets through the `rust.chat` report target. Hiding a hidden line changes nothing. Recorded in the activity log. Admins and moderators.'
+  // #swagger.parameters['id'] = { in: 'path', required: true, description: 'The chat line’s event id', schema: { type: 'integer' } }
+  /* #swagger.responses[204] = { description: 'Hidden' } */
+  /* #swagger.responses[404] = { description: 'No such chat line' } */
+  requireRole('admin', 'moderator'),
+  param('id').isInt({ min: 1 }),
+  validate,
+  admin.hideChat,
+)
+
+adminRustRouter.post(
+  '/chat/:id/unhide',
+  // #swagger.tags = ['Admin · Rust']
+  // #swagger.summary = 'Show a hidden chat line again'
+  // #swagger.description = 'Undoes a hide for everyone, whether it was made here or from the Reports queue. Recorded in the activity log. Admins and moderators.'
+  // #swagger.parameters['id'] = { in: 'path', required: true, description: 'The chat line’s event id', schema: { type: 'integer' } }
+  /* #swagger.responses[204] = { description: 'Shown again' } */
+  /* #swagger.responses[404] = { description: 'No such chat line' } */
+  requireRole('admin', 'moderator'),
+  param('id').isInt({ min: 1 }),
+  validate,
+  admin.unhideChat,
+)
+
 // ── The map's picture (phase 14) ──────────────────────────────────────────
 
 adminRustRouter.post(