test(teams): the four acceptance criteria, and regenerate the API artifacts

Four tests are named "acceptance" and are Phase 4's criteria verbatim. Each names
a property the code around it can lose without any screen looking different:

1. A granted, unlinked account reads the forum, is absent from the member rows, and
   is still refused external-platform eligibility. The membership projection is
   asserted byte-identical across a grant, which is what "non-contamination" means
   in practice.
2. With the switch off every forum route 404s AND nothing is read or written on the
   way there — a guard that 404s after loading the thread is one that still bumped
   a counter.
3. The stored HTML is byte-identical between `disabled` and `remote`; only the
   rendered output differs. That is the property the renderer-owned design exists
   to give, and it is what makes flipping the policy back a no-op rather than a
   migration.
4. Selecting `uploads` without a matching acknowledgement is refused server-side,
   with the admin checkbox bypassed.

Plus the ones that are not criteria but are the same kind of claim: an author
cannot smuggle an <img> or its attributes through in any mode, http and non-image
URLs stay plain links, a leader cannot revoke a staff-issued grant, a demoted
account stops protecting the grants it made, moderation records which authority was
exercised, and a RIFF container that is not WebP is not accepted as one.

Twelve new routes in the manifest, all annotated and in the OpenAPI spec.

Co-Authored-By: Claude <noreply@anthropic.com>

server/routes.manifest.json

@@ -309,6 +309,10 @@
       "method": "POST",
       "path": "/api/v1/admin/teams/:id/display-name"
     },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/teams/:id/forum/moderation"
+    },
     {
       "method": "GET",
       "path": "/api/v1/admin/teams/:id/grants"
@@ -329,6 +333,14 @@
       "method": "POST",
       "path": "/api/v1/admin/teams/:id/unhide"
     },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/teams/forum/settings"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/admin/teams/forum/uploads"
+    },
     {
       "method": "GET",
       "path": "/api/v1/admin/teams/requests"
@@ -665,6 +677,42 @@
       "method": "GET",
       "path": "/api/v1/player/teams/:slug/access"
     },
+    {
+      "method": "GET",
+      "path": "/api/v1/player/teams/:slug/forum/threads"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/player/teams/:slug/forum/threads"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/player/teams/:slug/forum/threads/:id"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/player/teams/:slug/forum/threads/:id/moderate"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/player/teams/:slug/forum/uploads"
+    },
+    {
+      "method": "DELETE",
+      "path": "/api/v1/player/teams/:slug/forum/uploads/:id"
+    },
+    {
+      "method": "GET",
+      "path": "/api/v1/player/teams/:slug/grants"
+    },
+    {
+      "method": "POST",
+      "path": "/api/v1/player/teams/:slug/grants"
+    },
+    {
+      "method": "DELETE",
+      "path": "/api/v1/player/teams/:slug/grants/:userId"
+    },
     {
       "method": "POST",
       "path": "/api/v1/public/contact"