fix(demo): lock removing a Steam link on the demo (DM27)

The step-5 walk found demo-player could remove its stand-in Steam link from
its Rust page, and staff could remove it from Admin -> Users. That link is
what the player tour's Rust pages, rewards and grants hang on.

- module.json demoLocks gains DELETE /player/rust/links/:steamId.
- The staff route, DELETE /admin/users/:id/rust/links/:steamId, serves under
  core's users mount, which a module's demoLocks may not name, so its handler
  refuses with DEMO_LOCKED behind ctx.demoMode before the link is touched.

Off the demo both behave as before. Checked on a real core with the demo
seed: both answer 403 DEMO_LOCKED and the link stays.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/demo.js

@@ -1,9 +1,13 @@
 // ── The public demo's module-side locks (DEMO_MODE.md §3.4, §3.5) ──────────
 //
-// Core locks this module's two link routes by `demoLocks` in module.json. What a
-// route list cannot express lives here, behind `ctx.demoMode` (MODULE_API
-// 1.18.0), and every handler that enforces one of these asks this file:
+// Core locks this module's two rig-link routes and the player's Steam unlink by
+// `demoLocks` in module.json. What a route list cannot express lives here, behind
+// `ctx.demoMode` (MODULE_API 1.18.0), and every handler that enforces one of these
+// asks this file:
 //
+//   the staff Steam unlink on Admin → Users (step-5 walk, W4): it serves under
+//     core's users mount, which a module's demoLocks may not name, so its handler
+//     refuses instead. The demo player's seeded link stays put either way;
 //   the console-command deny list (§3.4, DM11): the commands that would break
 //     the rig for every visitor until the next wipe. Asked at save, through
 //     core's `demoRefuses` hook (1.19.0, DM18), and again at run;