docs(website): Steam sign-in built (MODULE_API 1.17.0)

STEAM_SIGNIN.md gains its Built section (section 8) and status;
MODULE_API.md records 1.17.0 (ctx.identities.list, onIdentityLinking,
onIdentityLinked); BACKEND_DESIGN.md gains the auth_providers /
user_identities shapes, the identities route with ?id=, and the Steam
security notes in section 6; PLAN_REDESIGNS section 15 notes the build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

website/STEAM_SIGNIN.md

@@ -1,7 +1,8 @@
 # Sign in with Steam — plan
 
-> **Status: plan, written 2026-10-14; its questions answered 2026-10-19 (§7, D392–D396). Nothing is built.** It is
-> built on the website's `edge` and ships in the cutover in progress (the org lead, 2026-10-19).
+> **Status: plan, written 2026-10-14; its questions answered 2026-10-19 (§7, D392–D396); built 2026-10-19 on
+> the website's and Module-Rust's `edge` (§8).** It ships in the cutover in progress (the org lead, 2026-10-19).
+> The live walk with a real Steam account (§6) is owed.
 > It is the website's own plan for Steam sign-in, as Rust's
 > [`PLAN_FIXES.md`](../modules/rust/PLAN_FIXES.md) D171 set out (§4.8 there), and it is on the roadmap as the
 > `website` milestone *Steam sign-in*, issue website#214. Rust's [`PLAN_REDESIGNS.md`](../modules/rust/PLAN_REDESIGNS.md) §15 links
@@ -142,3 +143,31 @@ The org lead answered Q1–Q4 and ruled on the case Q1 and Q2 raised together. T
 | **D394** | **Steam needs a Steam Web API key to be enabled.** Admin → Auth refuses to enable Steam without one; with it, a linked Steam account shows its persona name and avatar. The key is stored like a client secret and is never returned. A failed lookup never stops a sign-in. | An optional key with bare ids without it; never calling the Web API. |
 | **D395** | **Steam never signs anybody up.** An unlinked Steam id signs nobody in, even when `player_registration` allows SSO sign-up; a player links Steam to an account they already have. | Sign-up through Steam with no email. |
 | **D396** | **A Steam link whose id is already another website account's Rust link is refused.** Alice sees *"This Steam account is already linked to another account on this site"*, and nothing changes. If her claim is real, staff remove Bob's Rust link and she links again. Core makes this possible through a module pre-link check (§4). | Steam wins and moves the Rust link to Alice; Alice gets the sign-in but not the Rust link. |
+
+## 8. Built (2026-10-19)
+
+On the `edge` branches of the cutover in progress, as §4 laid out:
+
+- **Core (`website`):** `steam.provider.js` does §3's checks and the `check_authentication` POST;
+  `registry.js` makes Steam a built-in (priority 3) whose only requirement is the Web API key;
+  `sso.controller.js` reads Steam's `openid.*` callback (`openid.mode=cancel` reads as denied), never
+  provisions for Steam, refreshes the name and avatar on each sign-in, and asks the modules before and
+  after a link (`auth/identityHooks.js`). Admin → Auth has a Steam tab; the account pages list each Steam
+  account with its name, avatar and id, keep *Link Steam* offered for another, and unlink one by
+  `?id=`. MODULE_API **1.17.0**. 32 Steam tests beside the existing suite.
+- **Module-Rust:** `checkSteamSignin` (D396) and `linkFromSteamSignin` (D392) in the links model,
+  `coreApi ^1.17.0`; the Rust page says linking Steam on the account page links it there too.
+- **Android-app:** the sign-in sheet already lists providers by name, so Steam needed no button work.
+  The account screen shows *Steam: <name>* with the SteamID64 and unlinks one account by id; before
+  this, unlinking would have removed every Steam account at once.
+
+**Walked locally (2026-10-19)** on a copy of the Rust walk database with Module-Rust loaded: the schema
+upgrade and a fresh install; Admin → Auth refusing to enable Steam with no key and saving one
+encrypted; *Continue with Steam* on the player login and the redirect to steamcommunity.com with §3's
+fields; through core's real `finishLink`, a free Steam id becoming a Rust link (D392), another
+account's Rust link refused with nothing written (D396), a second Steam account linked, and an id
+already linked elsewhere refused by core; and, in the browser, both accounts on the account page,
+unlinking one, and its Rust link staying (D393).
+
+**Owed:** §6's live walk with a real Steam account and key, on the web and in the app. It needs the org
+lead and joins the end walk's in-game rows.