feat(rust): Rust's own world events — feed, credit rule, triggers, Call a world event (PLAN_REDESIGNS §14.3.1)

The site half of stage 1, on protocol 14:

- server/worldEvents.js: the 24 types, D372's four credit rules, the grid
  from the map's geometry (none off the map), and the per-viewer reading.
- The feed serves `world.event` (a public kind): an unknown type is staff's;
  the event and its grid are public; names only for the presence audience
  (D376); Steam ids and positions only for staff (D353). A downed one carries
  `credited`/`creditedCount` by the server's rule. Client lines for all 24
  types and a World events filter.
- rust_servers.credit_rule (blow, last, most, all; default blow), set on the
  server's settings. Ingest counts heli_kills (patrol helicopters and
  Chinooks, D379) and apc_kills from `world.event` by that rule, so the line
  and Rotorbane / Tankbreaker agree. A protocol-13 tally's heliKills/apcKills
  still add as before.
- The tally's cratesHacked / dropsLooted → crates_hacked / drops_looted;
  title categories Safecracker and Scavenger (D356); leaderboard columns
  Crates hacked and Drops looted, sortable (D377).
- 24 engagement triggers rust.world.<event> (D355): ceiling everyone,
  cooldown subject the server and event (crates add where), names only.
- server/eventWorldCall.js: rust.world.call, "Call a world event"
  (risk change, reversible none, budget rust.world.calls). A position for an
  airdrop or a patrol helicopter only; the Chinook takes none (D378).

Server 585/585 (22 new in test/worldEvents.test.js), client 84/84, every
check; booted against the pinned core (43 triggers, 12 actions, 10 budgets,
20 option sources), routes.manifest unchanged at 89. Engagement manifest and
swagger fragment regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/servers/servers.db.js

@@ -24,7 +24,7 @@ async function listServers({ enabledOnly = false } = {}) {
   return core.query(
     `SELECT id, name, sidecar_base_url AS sidecarBaseUrl, sidecar_token_enc AS sidecarTokenEnc,
             protocol, enabled, sort_order AS sortOrder, announce_news AS announceNews,
-            news_delivery AS newsDelivery,
+            news_delivery AS newsDelivery, credit_rule AS creditRule,
             wipe_rule AS wipeRule, wipe_day AS wipeDay, wipe_time AS wipeTime, wipe_tz AS wipeTz,
             DATE_FORMAT(wipe_anchor, '%Y-%m-%d') AS wipeAnchor, wipe_once_at AS wipeOnceAt,
             created_at AS createdAt, updated_at AS updatedAt
@@ -37,7 +37,7 @@ async function listServers({ enabledOnly = false } = {}) {
 async function getServer(id) {
   const rows = await core.query(
     `SELECT id, name, sidecar_base_url AS sidecarBaseUrl, sidecar_token_enc AS sidecarTokenEnc,
-            protocol, enabled, sort_order AS sortOrder,
+            protocol, enabled, sort_order AS sortOrder, credit_rule AS creditRule,
             wipe_rule AS wipeRule, wipe_day AS wipeDay, wipe_time AS wipeTime, wipe_tz AS wipeTz,
             DATE_FORMAT(wipe_anchor, '%Y-%m-%d') AS wipeAnchor, wipe_once_at AS wipeOnceAt,
             created_at AS createdAt, updated_at AS updatedAt
@@ -97,6 +97,15 @@ async function setSchedule(id, { wipeRule, wipeDay, wipeTime, wipeTz, wipeAnchor
   )
 }
 
+/**
+ * One server's credit rule (D372). Its own statement, like the schedule, and for
+ * the same reason: written only when a save carries one, so a client that
+ * predates the rule cannot reset it to the default.
+ */
+async function setCreditRule(id, rule) {
+  await core.query(`UPDATE ${SERVERS} SET credit_rule = ? WHERE id = ?`, [rule, id])
+}
+
 async function deleteServer(id) {
   await core.query(`DELETE FROM ${SERVERS} WHERE id = ?`, [id])
 }
@@ -256,6 +265,7 @@ module.exports = {
   getServer,
   upsertServer,
   setSchedule,
+  setCreditRule,
   deleteServer,
   listState,
   getState,