feat(rust): Rust's own world events — feed, credit rule, triggers, Call a world event (PLAN_REDESIGNS §14.3.1)

The site half of stage 1, on protocol 14:

- server/worldEvents.js: the 24 types, D372's four credit rules, the grid
  from the map's geometry (none off the map), and the per-viewer reading.
- The feed serves `world.event` (a public kind): an unknown type is staff's;
  the event and its grid are public; names only for the presence audience
  (D376); Steam ids and positions only for staff (D353). A downed one carries
  `credited`/`creditedCount` by the server's rule. Client lines for all 24
  types and a World events filter.
- rust_servers.credit_rule (blow, last, most, all; default blow), set on the
  server's settings. Ingest counts heli_kills (patrol helicopters and
  Chinooks, D379) and apc_kills from `world.event` by that rule, so the line
  and Rotorbane / Tankbreaker agree. A protocol-13 tally's heliKills/apcKills
  still add as before.
- The tally's cratesHacked / dropsLooted → crates_hacked / drops_looted;
  title categories Safecracker and Scavenger (D356); leaderboard columns
  Crates hacked and Drops looted, sortable (D377).
- 24 engagement triggers rust.world.<event> (D355): ceiling everyone,
  cooldown subject the server and event (crates add where), names only.
- server/eventWorldCall.js: rust.world.call, "Call a world event"
  (risk change, reversible none, budget rust.world.calls). A position for an
  airdrop or a patrol helicopter only; the Chinook takes none (D378).

Server 585/585 (22 new in test/worldEvents.test.js), client 84/84, every
check; booted against the pinned core (43 triggers, 12 actions, 10 budgets,
20 option sources), routes.manifest unchanged at 89. Engagement manifest and
swagger fragment regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/events/events.db.js

@@ -148,6 +148,9 @@ const TITLE_SUMS = {
   rockets: 'rockets',
   explosives: 'explosives',
   missions: 'missions',
+  // Protocol 14 (D356): Safecracker and Scavenger.
+  cratesHacked: 'crates_hacked',
+  dropsLooted: 'drops_looted',
 }
 
 /** The two *best* fields and their columns: the longest single kill, never a sum. */
@@ -339,7 +342,15 @@ async function recentEvents({ serverId, kinds, wipeId = null, limit = 50 }) {
  */
 async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit = 25, balanceFloor = null }) {
   const byBalance = sort === 'balance' && wipeId && Number.isFinite(balanceFloor)
-  const column = { kills: 'kills', deaths: 'deaths', npcKills: 'npc_kills', playtime: 'playtime_sec' }[sort] || 'kills'
+  const column = {
+    kills: 'kills',
+    deaths: 'deaths',
+    npcKills: 'npc_kills',
+    playtime: 'playtime_sec',
+    // Protocol 14 (D356, D377): the columns Safecracker and Scavenger bring.
+    cratesHacked: 'crates_hacked',
+    dropsLooted: 'drops_looted',
+  }[sort] || 'kills'
 
   const params = [serverId]
   let where = 's.server_id = ?'
@@ -363,6 +374,8 @@ async function leaderboard({ serverId, wipeId = null, sort = 'kills', limit = 25
             SUM(s.npc_kills) AS npcKills,
             SUM(s.structures) AS structures,
             SUM(s.playtime_sec) AS playtimeSec,
+            SUM(s.crates_hacked) AS cratesHacked,
+            SUM(s.drops_looted) AS dropsLooted,
             MAX(s.balance) AS balance,
             MAX(s.last_seen) AS lastSeen
        FROM ${STATS} s