feat(houses): tier house visibility — public IDOC-only, staff full, player own

Per request, split the single public house registry into three role-scoped views:

- Public /site/houses → only houses in DANGER (IDOC), by LOCATION (region + map/
  coords). No owner, price, co-owners or decay detail. Renamed "Houses in danger";
  kept live via the public house.decay feed. The full-registry deltas
  (house.update / house.remove — which carry owner/price) are REMOVED from the
  public SSE allowlist so they never reach the public channel.
- Staff full registry → new /admin/houses (admin + moderator, RoleGate + MOD_PATHS)
  backed by GET /admin/shard/houses (modAccess), with owner/price/co-owners/decay
  and search, kept live on the admin SSE channel.
- Player portal → "My houses" home-status section (own houses only, with decay/
  IDOC status) via GET /player/shard/houses, scoped to the caller's linked accounts.

Server tests green, client build clean, swagger regenerated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/utils/shardBroadcast.js

@@ -36,15 +36,17 @@ const PUBLIC_KINDS = new Set([
   // Champion-spawn board deltas — the public Champions page renders these live.
   'champ.update',
   'champ.remove',
-  // Protocol 2.0 boards — all public, rendered live on their respective pages.
+  // Protocol 2.0 boards — public, rendered live on their respective pages.
   'guild.update',
   'guild.remove',
   'guild.join',
   'city.update',
   'presence.online',
   'region.enter',
-  'house.update',
-  'house.remove',
+  // NOTE: house.update / house.remove (the full registry — owner, price, co-owners)
+  // are deliberately NOT public. The public Houses page shows only IDOC houses (via
+  // house.decay, which is public above) with location only; the full registry is
+  // staff-only and rides the admin SSE channel. See public/shard.controller getHouses.
 ])
 
 // Open response streams per channel.