feat(site): phase 18 - the Rust screenshots, web and app

Nine captures tagged rust (D65): the server list, feed, leaderboard,
live map, permissions and the RunicNPC profile editor on the web, and a
server's feed, its map and the player's Rust account in the app, from
an Android-app edge debug build.

D80: every name in a capture is a role (admin, moderator, player...),
from this phase on. D81: the Rust demo's players are mock data written
by scripts/mockRustDemo.mjs; the server, its status, map, permission
groups and RunicNPC sync state are the real Oxide test server's. The
captions and /modules/rust/ and /app/ say which part is a demo cast.

seedDemo.mjs gains --game rust (server row with a weekly wipe, public
presence for the demo, two NPC profiles, a VIP group). captureScreens.mjs
gains a click list per screen. The homepage shows the Rust live map beside
the UO capture (D76); three Rust docs pages carry their screen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

PLAN.md

@@ -2365,6 +2365,86 @@ pass found 49 words on seven marketing pages; all are gone.
   one-time link code, which the existing "everything you read and post" row already covers. Its
   wording lost "shard", so `PLAY_DATA_SAFETY.md` was regenerated.
 
+### How phase 18 built it
+
+Two decisions, taken by the org lead on 2026-10-22 while the phase was under way. The count of
+record is now **eighty-one**.
+
+**D80 — a name in a screenshot is a role.** Every username a capture shows — a site account, a
+player in a feed, a member of a group — is `admin`, `moderator` or `player`, numbered
+(`player2` …) when one screen needs several. A name that says what the account is reads as a
+demonstration; an invented person's name reads as somebody's real community. It holds from
+this phase on: the phase 9 captures keep their cast, by the org lead's ruling ("no going back
+to change the old ones").
+
+**D81 — the Rust captures' players are mock data.** The rig has no players. The phase first
+staged stand-in players on it with a rig-only plugin, and the org lead stopped that in favour
+of writing the game data straight into the demo's database. This amends D4 for the Rust
+captures only. What is real in them is still most of the screen: a real Oxide test server
+behind a real rust-link sidecar, its status, its world map and markers, the permission groups
+its plugins hold, and RunicNPC's sync state. What is mock is the players: the feed, the
+leaderboard, the weapon kills, the server list's player count and the linked Steam account.
+`scripts/mockRustDemo.mjs` writes them as SQL in the module's own row shapes, and every name
+in them is a role (D80). The captions describe what a screen does and never claim a player did
+something; `screens.mjs`, `/modules/rust/` and `/app/` say plainly which part is a demo cast.
+The homepage's Rust capture (D76) is the live map, because nothing in that frame is mocked.
+The alternative, staging real kills with stand-ins, was abandoned after it cost a morning:
+the Rust update had left the rig rebuilding its navmesh for ten minutes, and it stopped
+answering the console for most of that time.
+
+**The demo is a second deployment.** One deployment runs one game module (the core refuses a
+second at boot), so the Rust demo has its own database, `rgdemorust`, its own core on the
+review machine, and Module-Rust v0.5.0. The recipe, in order:
+
+1. Bring the rig up to date (Rust, Oxide and Carbon, the rig rule). The org lead ruled one rig
+   enough: the Oxide rig, now Rust 26139947 and Oxide 2.0.7839. A restart did not update Rust:
+   steamcmd cancelled the delta on a DLL Oxide patches ("Corrupt game files"), and a panel
+   reinstall did not help either. Removing `steamapps/appmanifest_258550.acf` and starting
+   made steamcmd verify everything and finish. The Carbon rig was left on 25902425.
+2. Create the database (without a `COLLATE` clause) and start the core against it with
+   `MODULES_DIR` holding the module and `BRAND_NAME="Runic Gateway Demo"`. Create `admin`,
+   `moderator` and `player` with generated passwords.
+3. `node scripts/seedDemo.mjs --game rust`, with `RG_RUST_SERVERS` naming a JSON file outside
+   the repository that holds the server's id, name, sidecar address and token. It writes the
+   neutral identity, the two accounts, the server row with a weekly wipe, public visibility
+   for who is online and the map's players (the demo's choice, said in the seed), two RunicNPC
+   profiles on a kit the rig's Kits holds, and a VIP group with `player` in it.
+4. `node scripts/mockRustDemo.mjs`, piped into the database, after the site has seen the
+   server once so its current wipe exists.
+5. `npm run screens:capture` with the Rust ids. Set the server's player count just before
+   `rust-servers`, since the live server writes its own every thirty seconds.
+
+**What was built.**
+
+- **Nine captures**, all tagged `rust`: six web (the server list, the feed, the leaderboard,
+  the live map, the permissions screen with a group open, and the NPC profile editor) and three
+  phone (a server's feed, its map, and the player's Rust account). The phone ones are from an
+  `Android-app` `edge` debug build on the `s22_ultra` AVD, signed in as `player`; the Rust
+  screens were not in a release yet. The app's server list was left out: one server card on a
+  phone-height screen is mostly empty.
+- **`captureScreens.mjs` can click.** An entry may carry `click`, the visible text of what to
+  click before the shot, for a subject behind a tab or a button the route cannot reach — the
+  permissions group and the profile editor. A step that matches nothing fails the shot.
+- **Where they show:** `/modules/rust/` (the public four under what players see, the two staff
+  screens under theirs, with a sentence saying which part is a demo cast); the homepage's
+  *What it looks like*, the live map beside the Ultima Online capture (D76); `/app/`'s grid,
+  whose lede no longer says "not mocked up"; and three docs pages — the live map, permissions
+  and groups, and RunicNPC's NPC profiles.
+
+**What the phase found**, reported, not fixed here:
+
+- **The feed prints prefab names as weapons**: "with ak47u entity", "with bolt rifle entity".
+  The bridge sends `weapon` as the held entity's short prefab name, and Module-Rust's feed
+  prints it through `format.js`'s `prefab()`, which only turns dots and underscores into
+  spaces; the app does the same. It is in the captures as
+  the product shows it.
+- **The app's first-run and sign-in screens say "shard"** ("Connect to your shard", "Sign in
+  with your shard account"), on every deployment, a Rust one included.
+- **The permissions screen's Players tab lists Steam ids the rig already held**, among them
+  the org lead's own account from the player walk. That is the screen working (D31's reversal
+  adopts every grant), and why the capture opens the Groups tab; it is noted because any
+  demo pointed at a rig shows them.
+
 ---
 
 [api]: https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/website/MODULE_API.md