test(server): port core's UO suite onto the ctx harness

22 test files moved from core, plus the two that were split out of files core
keeps. 351 tests pass.

One change runs through every moved test, and it is the boundary rather than a
chore: core internals can no longer be stubbed by requiring them, because there
are none to require. `../utils/db` and `../model/settings` do not exist here.
What a test controls instead is the ctx core would have handed over, installed
once by test/_setup.js -- which is a better seam anyway, since it is exactly the
surface the contract promises and nothing wider.

The ctx _setup installs is deliberately unfrozen. Core freezes what it hands a
module and entry.test.js still asserts against a frozen one; but a test that
needs settings.get to return a path has to be able to say so.

Two tests changed SHAPE, and that is the boundary too. fromShardEvent used to
assert through publish() into pushDevices and a captured fetch -- which
endpoints were hit, how many requests went out. None of that is this module's
any more: publish is ctx.push.publish, and the device registry and the relay are
behind it. Reaching for them from here would be reaching past ctx. What remains
is what the module owns and is the part worth guarding: a game account resolves
to a website user, a personal target that resolves to nobody is dropped rather
than published, and a sensitive kind never reaches publish at all.

Co-Authored-By: Claude <noreply@anthropic.com>

server/test/publicShardOnline.test.js

@@ -0,0 +1,109 @@
+// Ported from core in Phase 3 (MODULE_SYSTEM.md §2.7.1). One change runs through
+// every moved test: core internals can no longer be stubbed by requiring them,
+// because there are none to require — `../utils/db` and `../model/settings` do
+// not exist here. What a test controls instead is the `ctx` core would have
+// handed over, installed once by `test/_setup.js`, which is the seam the
+// contract actually promises.
+
+// Staff-location visibility on GET /public/shard/online. The endpoint is
+// token-free, so it inspects the caller's session (getUserFromRequest) and only
+// includes each staff member's in-game location (map/x/y/z) for admins and
+// moderators. Players and the public still see who is online, but not where.
+//
+// Point the DB at a closed port BEFORE requiring anything that builds the pool,
+// so any stray query fails fast instead of hanging. The model + auth are stubbed,
+// so the DB is never actually hit.
+
+const { test, after, afterEach } = require('node:test')
+const assert = require('node:assert/strict')
+
+const ctrl = require('../router/public/shard.controller')
+const shardState = require('../model/shardState/shardState.model')
+const { ctx } = require('./_setup')
+const auth = ctx.auth
+
+
+function mockRes() {
+  return {
+    statusCode: 200,
+    body: null,
+    status(c) {
+      this.statusCode = c
+      return this
+    },
+    json(b) {
+      this.body = b
+      return this
+    },
+  }
+}
+
+// One online staff member with a location the model would return.
+const ONLINE_ROW = { serial: '0x1', name: 'Lady Mod', map: 'Felucca', x: 1495, y: 1628, z: 10 }
+
+const originals = {
+  listOnlineLinked: shardState.listOnlineLinked,
+  getUserFromRequest: auth.getUserFromRequest,
+}
+afterEach(() => {
+  shardState.listOnlineLinked = originals.listOnlineLinked
+  auth.getUserFromRequest = originals.getUserFromRequest
+})
+
+// Stub the model to return the staff member, and the session to the given viewer.
+function setup(viewer) {
+  shardState.listOnlineLinked = async () => [ONLINE_ROW]
+  auth.getUserFromRequest = () => viewer
+}
+
+const LOCATION_KEYS = ['map', 'x', 'y', 'z']
+
+for (const role of ['admin', 'moderator']) {
+  test(`getOnline includes location for a ${role}`, async () => {
+    setup({ id: 1, username: 'staff', role })
+    const res = mockRes()
+    await ctrl.getOnline({}, res)
+    assert.equal(res.statusCode, 200)
+    assert.equal(res.body.length, 1)
+    const entry = res.body[0]
+    assert.equal(entry.name, 'Lady Mod')
+    assert.equal(entry.serial, '0x1')
+    assert.equal(entry.map, 'Felucca')
+    assert.equal(entry.x, 1495)
+    assert.equal(entry.y, 1628)
+    assert.equal(entry.z, 10)
+  })
+}
+
+test('getOnline omits location for a logged-in player', async () => {
+  setup({ id: 2, username: 'joe', role: 'player' })
+  const res = mockRes()
+  await ctrl.getOnline({}, res)
+  assert.equal(res.statusCode, 200)
+  const entry = res.body[0]
+  // Still shows they are online…
+  assert.equal(entry.name, 'Lady Mod')
+  assert.equal(entry.serial, '0x1')
+  // …but the location fields are absent entirely (not null/placeholder).
+  for (const k of LOCATION_KEYS) assert.ok(!(k in entry), `expected "${k}" to be omitted`)
+})
+
+test('getOnline omits location for an unauthenticated request', async () => {
+  setup(null) // getUserFromRequest returns null for anon callers
+  const res = mockRes()
+  await ctrl.getOnline({}, res)
+  assert.equal(res.statusCode, 200)
+  const entry = res.body[0]
+  assert.equal(entry.name, 'Lady Mod')
+  assert.equal(entry.serial, '0x1')
+  for (const k of LOCATION_KEYS) assert.ok(!(k in entry), `expected "${k}" to be omitted`)
+})
+
+// An editor is staff but not admin/moderator — they should not see location.
+test('getOnline omits location for an editor', async () => {
+  setup({ id: 3, username: 'ed', role: 'editor' })
+  const res = mockRes()
+  await ctrl.getOnline({}, res)
+  const entry = res.body[0]
+  for (const k of LOCATION_KEYS) assert.ok(!(k in entry), `expected "${k}" to be omitted`)
+})