feat(atlas): serve the spawn atlas and give operators a panel for it

Protocol 3.0 order 3 (Part C), second of two website PRs. #112 built the data
pipeline; this makes it reachable — six public routes, five admin ones, two
public pages and an admin panel. Still website-only: no plugin, no sidecar, no
new event kinds, no wire change.

The API sits at /api/v1/public/atlas, not under /public/shard. Nothing here
touches the sidecar, so the pages stay complete while the shard is down, and a
/shard prefix would imply a dependency the atlas does not have. Unlike /shard/*
it IS site-mode gated, like /posts and /wiki: a bestiary is site content.

Every route carries requireFeature('atlas') and projects its response. The atlas
feature declares no sensitive fields, so the projection is a no-op today — the
call is there because v3.md 3.6.1's rule is that the FIRST field needing a gate
should be covered by construction rather than by a retrofit.

Two bugs the UI surfaced, both fixed here:

Respawn delays were stored in the wrong unit, sometimes. XmlSpawner writes
MinDelay/MaxDelay in minutes and switches to seconds only when a delay does not
divide into whole minutes, flagging it per record with DelayInSec. A `5` means
five minutes on one spawner and five seconds on the next, both plausible, and
the pipeline stored the raw number. 170 of 6,455 stock spawners are second
flagged. The parser normalises to seconds; the API and UI carry seconds.

That exposed the hash gate as a trap. "Has the tree changed?" is the wrong
question on its own: an install whose maps never change would have kept serving
the old readings forever, because the only thing compared was the tree.
PARSER_VERSION is now stored beside the source hashes and a mismatch counts as
drift, so any future parse correction lands on the next boot.

Also renamed the detail route's spawn-point array to `spawners` — it was
`points`, which is the COUNT on the search route, so one key meant a number in
one place and an array in the other.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U7CBg11prhLimL9iHSX1bP

server/src/utils/spawnAtlasParse.js

@@ -360,6 +360,20 @@ function tagValue(block, name) {
  * name. `Eodon.xml`, `GravewaterLake.xml` and the other named-area files all
  * carry TerMur/Trammel points, so there are 13 files but only 6 facets.
  */
+/**
+ * A spawner's respawn window, in seconds.
+ *
+ * `DelayInSec` decides the unit of `MinDelay`/`MaxDelay`; absent (older files)
+ * it is false, which is minutes — the same default XmlSpawner assumes.
+ */
+function delaySeconds(block) {
+  const scale = toBool(tagValue(block, 'DelayInSec')) ? 1 : 60
+  return {
+    minDelay: toInt(tagValue(block, 'MinDelay')) * scale,
+    maxDelay: toInt(tagValue(block, 'MaxDelay')) * scale,
+  }
+}
+
 function parsePoints(source) {
   const text = String(source)
   const points = []
@@ -382,8 +396,16 @@ function parsePoints(source) {
       height: toInt(tagValue(block, 'Height')),
       range: toInt(tagValue(block, 'Range')),
       maxCount: toInt(tagValue(block, 'MaxCount')),
-      minDelay: toInt(tagValue(block, 'MinDelay')),
-      maxDelay: toInt(tagValue(block, 'MaxDelay')),
+      // Normalised to SECONDS here, because the unit is per-record. XmlSpawner
+      // writes minutes by default and switches to seconds only when a spawner's
+      // delay does not divide into whole minutes, flagging that with
+      // `DelayInSec` (XmlSpawner2.cs:7462-7480, read back at :6345-6358). Taken
+      // literally the two are indistinguishable — a `5` means five minutes on
+      // one spawner and five seconds on the next — so a consumer that assumed
+      // either unit would be wrong about the other. Stock ServUO 57.4 has ~30
+      // second-flagged spawners, few enough to look like noise and quietly
+      // mislabel.
+      ...delaySeconds(block),
       // Time-of-day gating: TODMode 0 means "always", in which case the start
       // and end values are meaningless and the site must not render them.
       todStart: toInt(tagValue(block, 'TODStart')),

server/src/utils/spawnAtlasSource.js

@@ -128,6 +128,21 @@ function hashSources(root) {
   return hashes
 }
 
+/**
+ * Bumped whenever the parser produces DIFFERENT data from IDENTICAL source
+ * files — a fixed misreading, a new field, a changed unit.
+ *
+ * Without it the hash gate is a trap: an install whose tree has not changed
+ * would keep serving what an older parser derived, indefinitely, because the
+ * only thing the boot path compares is the tree. The version is stored beside
+ * the source hashes and a mismatch counts as drift, so a deploy that corrects
+ * the parse actually reaches the data.
+ *
+ *   2 — respawn delays normalised to seconds (they are per-record minutes OR
+ *       seconds in the source, decided by `DelayInSec`).
+ */
+const PARSER_VERSION = 2
+
 /** True when two source fingerprints describe the same tree. */
 function sameSources(a, b) {
   if (!a || !b) return false
@@ -286,6 +301,7 @@ function buildAtlas(root, options = {}) {
   return {
     meta: {
       generatedAt: new Date().toISOString(),
+      parserVersion: PARSER_VERSION,
       landmarkRadius: options.landmarkRadius ?? undefined,
       counts: {
         facets: facets.length,
@@ -310,6 +326,7 @@ function buildAtlas(root, options = {}) {
 
 module.exports = {
   AtlasSourceError,
+  PARSER_VERSION,
   readSources,
   hashSources,
   sameSources,