feat(safety): report, block and hide chat lines (MODULE_API 1.21.0)

USER_SAFETY.md step 3, the module half of report, block and hide.

- server/safety.js registers the rust.chat report target (snapshot for one
  reader, null when they could not have seen the line; staff's hide and
  unhide) and the steam game identity (ownersOf from rust_account_links).
- The events feed filters chat per reader, in the query: lines from a
  blocked account's Steam ids, the reader's unlinked Steam-ID blocks and the
  lines they hid. Signed-in readers get canBlock on each chat line (false for
  their own and for staff-linked players). Lines staff hid for everyone are
  left out for everyone but staff, who get them with hidden: true.
- rust_events gains hidden_at and hidden_by (ALTER ... IF NOT EXISTS).
- POST /admin/rust/chat/:id/hide and /unhide (admin, moderator), logged.
- The feed's chat lines get a menu: Report, Hide for me, Block player,
  and for staff Hide for everyone / Show to everyone again.
- coreApi ^1.21.0; ci/core-ref.json pinned to the website#233 merge;
  routes.manifest.json and swagger-fragment.json regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/test/_fakes.js

@@ -91,6 +91,12 @@ function fakeCtx(overrides = {}) {
       },
     },
     activity: { log: spy(Promise.resolve()) },
+    // Report, block and hide (1.21.0). A reader with no blocks and no hides, and
+    // nobody staff; a suite that needs either installs its own.
+    safety: {
+      forViewer: spy(Promise.resolve({ blockedUserIds: [], blockedIdentities: {}, hidden: {} })),
+      staffAmong: spy(Promise.resolve([])),
+    },
     middleware: {
       requireAuth: (req, res, next) => next(),
       requireRole: () => (req, res, next) => next(),
@@ -175,6 +181,9 @@ function fakeApi() {
     onDemoSeed(fn) { once('onDemoSeed'); record.hooks.onDemoSeed = fn },
     // MODULE_API 1.20.0 (account deletion, ACCOUNT_DELETION.md §4.4).
     onUserDeleting(fn) { once('onUserDeleting'); record.hooks.onUserDeleting = fn },
+    // MODULE_API 1.21.0 (report, block and hide, USER_SAFETY.md §4.2).
+    registerReportTargets(targets) { once('registerReportTargets'); record.reportTargets = targets },
+    registerGameIdentities(identities) { once('registerGameIdentities'); record.gameIdentities = identities },
   }
   api.record = record
   return api