feat(sidecar): protocol 2 — file by type, a cursor feed, and bounded history

The sidecar now files a frame by its `type` and never by its `kind`. That is the
dumb-forwarder property made structural: `event` is appended to history,
`snapshot` replaces the board of its kind, `reply` is routed by `reqId`,
`control` is broadcast and kept nowhere. Ten new event kinds are no change here
at all, which is the whole point when the thing that grows fastest is the
catalogue.

A frame whose `type` this build does not know is dropped and counted, never
guessed at. Defaulting an absent one to `event` would file a BOARD as history —
the presence board appended a few thousand times, which nothing reports. The
count is on `/health` as `untyped_frames`, because the failure it diagnoses (a
plugin and a sidecar on different protocol versions, which the game link has no
handshake to catch) otherwise presents as a website showing nothing while the
game is plainly up. It caught exactly that within three seconds of first running,
against a protocol 1 plugin still live on a retired rig.

`boards` generalises protocol 1's single `server_state` row, and a database made
by protocol 1 is migrated in place: the two indexed columns are added by a
guarded `ALTER`, and the old board is carried across. Without that carry-over an
upgraded sidecar answers `204` until the game next connects, and the website
reads that as "never heard from" — losing a server it has rendered for weeks at
the exact moment somebody upgraded the bridge.

`GET /feed` is the ingest cursor: oldest first, strictly after an id, with
`lastId` and `more`. It is a separate route rather than a flag on `/events`
because one route with two orderings serves the other one to every caller that
forgets the parameter — and for the ingesting caller that means advancing its
cursor past rows it never read. Omitting `since` asks where the END is; `since=0`
is the other question entirely, and the two must not be separated by whether
somebody typed a parameter.

`[store].retain_days` (default 14) prunes events hourly. Boards are never pruned:
history grows and the present does not, and a pruned board is a server that has
never connected.

The repository also had no CI. `pr-checks.yml` runs the fmt, clippy and test
gates phases 1 and 3 have both been running by hand — a guard nothing invokes is
a guard whose state nobody knows.

44 tests pass, clippy clean at `-D warnings`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

sidecar/src/main.rs

@@ -57,7 +57,23 @@ use tracing_subscriber::EnvFilter;
 ///
 /// Both directions are newline-delimited JSON over TCP. Outbound frames (plugin -> sidecar) carry
 /// `kind`; inbound frames (sidecar -> plugin) carry `cmd`.
-pub const PROTOCOL_VERSION: u32 = 1;
+///
+/// # Protocol 2 — the read path
+///
+/// The catalogue: presence, deaths, chat, gathering, moderation and the wipe. Three things about
+/// it reach this file rather than only the plugin's:
+///
+///   * **Every frame carries `type`** — `event`, `snapshot`, `reply` or `control` — and this
+///     process files on THAT, never on `kind`. It is what keeps the sidecar a dumb forwarder while
+///     the catalogue grows: ten new event kinds are no change here at all.
+///   * **Every frame carries `serverId` and `wipeId`**, and both are lifted into indexed columns
+///     (the one migration shape the store's header predicted).
+///   * **`GET /feed`** is the ingest cursor, oldest-first, separate from `/events` so that no
+///     caller can get the other ordering by forgetting a parameter.
+///
+/// `docs/rust-link/PROTOCOL.md` §8 is the specification; this constant is one of its four
+/// declaration sites.
+pub const PROTOCOL_VERSION: u32 = 2;
 
 fn main() -> anyhow::Result<()> {
     let args = match cli::parse(std::env::args().skip(1)) {