feat(protocol2): website account provisioning & unlinking (Part A)

Adds the account-provisioning plane from docs/PROTOCOL_2.md Part A: the
website can create game accounts and unlink them, gated by a shard-wide
signup mode. The existing [link flow is unchanged.

Overlay:
- BridgeConfig: SignupMode (website|game|hybrid, default hybrid; unrecognized
  falls back to game), AccountCreateEnabled (mode-following default),
  RequireIpForCreate, name/password caps, and a boot warning when the core
  Accounts.AutoCreateAccounts setting contradicts the mode.
- BridgeAccounts (new): account.create (mode gate, actor required, char-safety
  mirrored from AccountHandler, collision check, per-IP cap via CanCreate/
  LogAccess with fail-closed missing/loopback IP, create + WebsiteUserId link,
  account.audit; password never logged or echoed) and account.unlink (Owner
  floor via BridgeAdmin.Protected, clears the tag).
- BridgeAccountLink: in-game [unlink command, emits account.unlinked.
- BridgeAdmin: Protected / ResolveTargetAccount promoted to public for reuse.

Sidecar:
- POST /accounts/create, DELETE /link/:account, respond_account status mapping
  (409 collision / 429 ip cap / 403 disabled|protected / 404 not-linked / 400).
- store.record_unlink drops the mirrored link row.
- PROTOCOL_VERSION -> 2 (outbound events additive; new endpoints need v2).

Docs: INTEGRATION.md protocol bump, account.* events, endpoints, 409/429;
PROTOCOL_2.md Part A marked built.

Verified: sidecar cargo check clean; overlay compiles in the full ServUO
Scripts tree (0 errors, 0 warnings). Live end-to-end run still pending.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

overlay/Scripts/Custom/Bridge/BridgeAdmin.cs

@@ -283,9 +283,10 @@ namespace Server.Custom.Bridge
 
         /// <summary>
         ///     Resolves the command's target account, by "serial" (a player mobile's account) or by
-        ///     "account" (username). Returns null if neither resolves to a real account.
+        ///     "account" (username). Returns null if neither resolves to a real account. Public so the
+        ///     account plane (unlink) resolves targets the same way the moderation plane does.
         /// </summary>
-        private static Account ResolveTargetAccount(Dictionary<string, object> o)
+        public static Account ResolveTargetAccount(Dictionary<string, object> o)
         {
             var serialStr = BridgeJson.GetString(o, "serial");
             if (serialStr != null)
@@ -301,9 +302,10 @@ namespace Server.Custom.Bridge
         /// <summary>
         ///     The one shard-side safety floor. Protects any account whose effective access level —
         ///     the account's own or the highest of its characters' — is at or above the configured
-        ///     floor. Even under CoOwner authority the Owner is never reachable from the web.
+        ///     floor. Even under CoOwner authority the Owner is never reachable from the web. Public
+        ///     so the account plane (unlink) enforces the identical floor.
         /// </summary>
-        private static bool Protected(Account acct)
+        public static bool Protected(Account acct)
         {
             var lvl = acct.AccessLevel;