feat(rust): the permission manager — the site owns the whole store (D160-D163, D188-D198)

PLAN_REDESIGNS section 1.

- Every sync reads the store (perm.inventory), reconciles it against the
  site's record and its ledger, and pushes. A change made in the game is
  settled by the server's policy (D161): auto-adopt (default), adopt, or
  revoke. The first read of a server imports everything (D198).
- Groups belong to one server unless an admin shares them (D189), in new
  id-keyed tables; the old ones are copied once at boot and left unread.
  Holders may be a Steam account nobody linked (D188).
- An in-game change affects that server only (D190): a grant that reaches
  further gains an exception, a shared group is split.
- Never judged: a permission the server does not register right now (an
  unloaded plugin is not a revocation), and a pair an event lease holds.
- A new admin API (server view, grant/revoke with everywhere-or-here,
  groups by id, share/split, members, drift answers) and a screen on
  PermissionsManager's flow with a state on every toggle (D162, D163, U-1).
- The announcement voice names a group by id; old name settings still read.

Walked on both rigs against the walk core: import on an existing install,
auto-adopt of a grant and a revoke, a fleet grant's exception, Kits
unloaded without loss, a shared group split, adopt and revoke policies.
Server 420/420, client 58/58, swagger, imports and route manifest current.

Refs #21

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/test/optionalMods.test.js

@@ -187,14 +187,19 @@ test('a voice has no sender: no username, and no stray colon where BetterChat’
 test('the desired set carries a style per field, and its value moves the digest but not the row’s identity', () => {
   const model = require('../model/permissions/permissions.model')
   const base = {
-    groups: [{ name: 'staff', title: 'Staff', rank: 0, scope: '*' }],
+    groups: [{ id: 1, name: 'staff', title: 'Staff', rank: 0, parent: '', allServers: true }],
+    groupServers: [],
     groupPermissions: [],
     members: [],
+    steamMembers: [],
     grants: [],
+    steamGrants: [],
+    exceptions: [],
     steamIdsByUser: new Map(),
+    // A style belongs to a group ROW since groups became per server (D189).
     groupChat: [
-      { groupName: 'staff', field: 'Title', value: '[Staff]' },
-      { groupName: 'staff', field: 'TitleColor', value: '#ff0000' },
+      { groupId: 1, field: 'Title', value: '[Staff]' },
+      { groupId: 1, field: 'TitleColor', value: '#ff0000' },
     ],
   }
   const a = model.buildDesired('main', base)
@@ -282,8 +287,9 @@ test('a style field landed only when BetterChat took it; drift keeps the game’
   assert.ok(!deletes.some((d) => d.includes('gone')), 'a group BetterChat has not removed stays, to be retired again')
   assert.ok(!deletes.some((d) => d.includes('chat-group')), 'a chat-group retirement is not a ledger row')
 
+  // Protocol 13: every "needs a person" row says which way it went.
   const drift = queries.find((q) => q.sql.startsWith('INSERT INTO rust_perm_drift'))
-  assert.deepStrictEqual(drift.params, ['main', 'chat-field', 'staff', 'TitleColor', '#123456'])
+  assert.deepStrictEqual(drift.params, ['main', 'chat-field', 'staff', 'TitleColor', '#123456', 'changed'])
 })
 
 test('with BetterChat absent no style field landed, and a withdrawn style is kept for later', async () => {