docs: record Q12-Q18 (D353-D359) and plan Steam sign-in on the website (D360)

The org lead answered §13's and §14's questions on 2026-10-14:
D353 public feed with name and grid, staff adds the Steam id; D354 an
event can call a vanilla event, kept at teardown; D355 every world event
is a trigger; D356 Safecracker and Scavenger; D357 protocol 14; D358
BotReSpawn stays out; D359 the end walk waits for RaidableBases (against
the proposal), recorded in §9 too.

D360: Steam sign-in in the same manner as Google and Discord, kept on
the website's plan (D171). New website/STEAM_SIGNIN.md (OpenID 2.0
adapter, the build per repo, security, tests, Q1-Q4), indexed in the
README, linked from PLAN_REDESIGNS §15 and PLAN_FIXES §4.8, and on the
roadmap as the website milestone "Steam sign-in" (website#214).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

modules/rust/PLAN_FIXES.md

@@ -374,6 +374,9 @@ a display name. The goal the org lead named is server customisation — NPCs wit
 
 ### 4.8 Steam sign-in (moved to the website's plan, D171)
 
+**Planned 2026-10-14 in [`../../website/STEAM_SIGNIN.md`](../../website/STEAM_SIGNIN.md)** (PLAN_REDESIGNS D360),
+on the roadmap as the `website` milestone *Steam sign-in*.
+
 Steam as a sign-in provider beside Google and Discord is part of the base website and is planned there, not
 here. What this module needs from it: a way to learn a signed-in account's verified Steam id, so linking by
 Steam can stand beside the in-game code (R1). Steam is OpenID 2.0, not OAuth2/OIDC, so the website needs its