fix(demo): lock removing a Steam link on the demo (DM27)

The step-5 walk found demo-player could remove its stand-in Steam link from
its Rust page, and staff could remove it from Admin -> Users. That link is
what the player tour's Rust pages, rewards and grants hang on.

- module.json demoLocks gains DELETE /player/rust/links/:steamId.
- The staff route, DELETE /admin/users/:id/rust/links/:steamId, serves under
  core's users mount, which a module's demoLocks may not name, so its handler
  refuses with DEMO_LOCKED behind ctx.demoMode before the link is touched.

Off the demo both behave as before. Checked on a real core with the demo
seed: both answer 403 DEMO_LOCKED and the link stays.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/test/demo.test.js

@@ -447,11 +447,40 @@ test('the seed sets the faction table, saves each profile, and styles each group
 
 // ── The manifest (§3.2) ────────────────────────────────────────────────────
 
-test('module.json locks the two link routes and needs a core that asks demoRefuses', () => {
+test('module.json locks the two rig-link routes and the player Steam unlink, and needs a core that asks demoRefuses', () => {
   const manifest = require('../../module.json')
   assert.deepEqual(manifest.demoLocks, [
     { method: 'PUT', path: '/admin/rust/servers/:id' },
     { method: 'DELETE', path: '/admin/rust/servers/:id' },
+    { method: 'DELETE', path: '/player/rust/links/:steamId' },
   ])
   assert.equal(manifest.coreApi, '^1.19.0')
 })
+
+// ── The staff Steam unlink (W4) ────────────────────────────────────────────
+
+test('staff cannot sever a Steam link on the demo, and the link is never touched', async () => {
+  for (const demoMode of [true, false]) {
+    withCore({ demo: demoMode })
+    const links = require('../model/links/links.model')
+    const asked = []
+    links.unlinkOwned = async (steamId, userId) => {
+      asked.push([steamId, userId])
+      return true
+    }
+    const res = fakeRes()
+    await require('../router/admin/usersRust.controller').removeLink(
+      { params: { id: '3', steamId: '76561190000000001' }, user: { id: 1 } },
+      res,
+    )
+    if (demoMode) {
+      assert.equal(res.statusCode, 403)
+      assert.equal(res.body.code, 'DEMO_LOCKED')
+      assert.deepEqual(asked, [])
+    } else {
+      assert.equal(res.statusCode, 200)
+      assert.deepEqual(res.body, { unlinked: true })
+      assert.deepEqual(asked, [['76561190000000001', '3']])
+    }
+  }
+})