fix(demo): lock removing a Steam link on the demo (DM27)

The step-5 walk found demo-player could remove its stand-in Steam link from
its Rust page, and staff could remove it from Admin -> Users. That link is
what the player tour's Rust pages, rewards and grants hang on.

- module.json demoLocks gains DELETE /player/rust/links/:steamId.
- The staff route, DELETE /admin/users/:id/rust/links/:steamId, serves under
  core's users mount, which a module's demoLocks may not name, so its handler
  refuses with DEMO_LOCKED behind ctx.demoMode before the link is touched.

Off the demo both behave as before. Checked on a real core with the demo
seed: both answer 403 DEMO_LOCKED and the link stays.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

module.json

@@ -16,6 +16,7 @@
   "capabilities": ["rust", "servers", "killfeed", "leaderboard", "presence", "wipes", "identity", "map"],
   "demoLocks": [
     { "method": "PUT", "path": "/admin/rust/servers/:id" },
-    { "method": "DELETE", "path": "/admin/rust/servers/:id" }
+    { "method": "DELETE", "path": "/admin/rust/servers/:id" },
+    { "method": "DELETE", "path": "/player/rust/links/:steamId" }
   ]
 }