Add shard activity feed + admin live feed; fix public-feed leak

Front ends for the rest of the sidecar data, plus a security fix the live data
surfaced.

- lib/shardEvents.js: shared describe()/category/label for every event kind
  (sales, deaths & PvP, skills, fame/karma, quests, world, and staff kinds).
- Public /site/shard/activity (ShardActivity): the full event log with category
  filter tabs and a live tail (history + SSE merged, de-duped). Linked from the
  Shard page. Shard page now reuses the shared describe().
- Admin: a "Live feed (all events)" panel on the Shard admin page subscribing to
  the admin SSE channel — shows every kind incl. audit/cheat/login attempts.
  useShardFeed generalized to take a stream url; api.adminShardStreamUrl added.

Security fix: GET /public/shard/feed now restricts to the public-safe kind
allowlist (shardEvents.list gains a `kinds` IN-filter). Previously it returned
whatever was logged — including audit.* / cheat.* / link.request. Those are
still stored for the admin channel but never served publicly (verified: a
public request for audit.command returns 0 rows).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011qPmpmVH1xGCiZoz9m9vW3

client/src/lib/useShardFeed.js

@@ -10,19 +10,20 @@ import { api } from '../api/client.js'
 // `connected` flag is exposed for a small live/offline indicator. `filter` (a
 // Set of kinds, optional) limits which events are buffered. `max` caps the
 // buffer length.
-export function useShardFeed({ filter, max = 40 } = {}) {
+export function useShardFeed({ url, filter, max = 40 } = {}) {
   const [events, setEvents] = useState([])
   const [connected, setConnected] = useState(false)
   // Keep the latest filter in a ref so re-renders don't tear down the stream.
   const filterRef = useRef(filter)
   filterRef.current = filter
+  const streamUrl = url || api.shardStreamUrl
 
   useEffect(() => {
     // EventSource isn't available during SSR / very old browsers — degrade to
     // "no live feed" rather than throwing.
     if (typeof window === 'undefined' || typeof window.EventSource === 'undefined') return undefined
 
-    const es = new EventSource(api.shardStreamUrl, { withCredentials: true })
+    const es = new EventSource(streamUrl, { withCredentials: true })
 
     es.onopen = () => setConnected(true)
     es.onerror = () => setConnected(false) // EventSource will retry on its own
@@ -47,7 +48,7 @@ export function useShardFeed({ filter, max = 40 } = {}) {
 
     return () => es.close()
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [max])
+  }, [max, streamUrl])
 
   return { events, connected }
 }