docs: record Q12-Q18 (D353-D359) and plan Steam sign-in on the website (D360)

The org lead answered §13's and §14's questions on 2026-10-14:
D353 public feed with name and grid, staff adds the Steam id; D354 an
event can call a vanilla event, kept at teardown; D355 every world event
is a trigger; D356 Safecracker and Scavenger; D357 protocol 14; D358
BotReSpawn stays out; D359 the end walk waits for RaidableBases (against
the proposal), recorded in §9 too.

D360: Steam sign-in in the same manner as Google and Discord, kept on
the website's plan (D171). New website/STEAM_SIGNIN.md (OpenID 2.0
adapter, the build per repo, security, tests, Q1-Q4), indexed in the
README, linked from PLAN_REDESIGNS §15 and PLAN_FIXES §4.8, and on the
roadmap as the website milestone "Steam sign-in" (website#214).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

README.md

@@ -36,6 +36,7 @@ sidecar as a service, and hands you the values the website needs.
 | [WIKI_UPGRADE.md](website/WIKI_UPGRADE.md) | Wiki subsystem upgrade notes |
 | [SHARD_VISIBILITY.md](website/SHARD_VISIBILITY.md) | Who sees which shard data — the admin-configurable audience framework |
 | [TRUSTED_DEVICES_MFA.md](website/TRUSTED_DEVICES_MFA.md) | TOTP two-factor, trusted devices and recovery codes |
+| [STEAM_SIGNIN.md](website/STEAM_SIGNIN.md) | **Plan** — Sign in with Steam as a built-in provider beside Google and Discord (OpenID 2.0), and a Steam id for modules |
 | [MODERATION_APPEALS.md](website/MODERATION_APPEALS.md) | Moderation actions, content reports and the appeals flow |
 | [SPAWN_ATLAS.md](website/SPAWN_ATLAS.md) | The bestiary / spawn atlas: what the shard contains, parsed from the shard's own ServUO files — served over the bridge since Protocol 8, so no shared filesystem |
 | [CLILOCS.md](website/CLILOCS.md) | UO's id → name table, so items have names. The shard decompresses and serves it over the bridge; the desktop conversion it replaced is gone |