feat(teams): the public Team pages, the two slots and the nav flag

TEAMS.md §3.1–§3.5. Four core pages — the index, a Team's overview, its full
roster and the player portal's "My Teams" — plus the two extension slots a
module adds to them, and the nav rows that lead there.

These are CORE routes, not module ones. A Team is a core platform entity that a
module merely populates, so the whole experience renders on bare core; a module
adds to these pages rather than supplying them.

`team.member.row` is declared with `{ displayName, isLeader, linked }` and not
§3.4's `{ memberKey, userId, displayName }`. The two documents contradict each
other and §3.2 is the one that is a security rule: a slot component runs in the
browser, so those props can only reach it by publishing a game-internal
identifier and a site account id in every public roster response, for every
visitor, module installed or not. Recorded as an amendment.

The presentation logic is split into lib/teams.js with its own tests, following
lib/teamAdmin.js, because these pages have to state differences that read as
bugs unless they are worded deliberately:

  - "37 members · 21 linked" — the gap is information (a character with no site
    account behind it), and the header says what each number IS rather than
    showing both and hoping;
  - an empty roster has three unrelated causes — nobody in the Team, a rung
    that shows nobody, and a module that could not be asked — and reporting the
    last as the first is a statement about the game that happens to be false;
  - a stale projection says how old it is rather than presenting itself as
    current.

`teams` is the first CORE nav row to carry a `feature` since the shard rows left
with the module cutover, and it brings core's own feature provider back with it.
It gates on whether this deployment has Teams AT ALL, not on who is looking —
Team pages are public and the server gates them. It fails open, so an unknown
answer shows the link: a Teams link leading somewhere empty is a far cheaper
mistake than a Team page nobody can find.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/modules/coreFeatures.js

@@ -0,0 +1,56 @@
+import { useEffect, useState } from 'react'
+
+// Core's own feature provider (TEAMS.md §3.5, MODULE_API.md §3.3).
+//
+// Core registered one here until the module cutover, under owner id `core` and
+// namespace `uo`, and it left with the shard rows. This brings the seam back with
+// content that is genuinely core's: `teams` gates the Teams nav rows, and Teams
+// are a core platform entity that a module merely populates.
+//
+// **What the flag actually answers is "does this deployment have Teams at all".**
+// Not "may this viewer see them" — Team pages are public (§0.7) and the server
+// gates them. On bare core, with no module supplying a Team provider and no rows
+// left behind by one, `/teams` is a permanently empty page and a link to it is
+// worse than no link. That is the whole job.
+//
+// It fails OPEN, like every other answer in this seam: while the request is in
+// flight, and on any error, the hook returns `null`, which `buildFeatureGate`
+// reads as "we do not know yet" and SHOWS the row. The page itself is the gate.
+// The one thing a UI mistake must never do here is hide a surface from someone
+// entitled to it — and a Teams link that leads somewhere empty is a far cheaper
+// mistake than a Team page nobody can find.
+
+// `limit=1` because only `enabled` is wanted. The endpoint answers it whatever
+// the page size, and asking for the default fifty would pull a roster's worth of
+// counts into a nav decision.
+const TEAMS_URL = '/api/v1/public/teams?limit=1'
+
+/**
+ * The hook core registers. Returns a Set-like of visible flags, or `null` while
+ * the answer is unknown.
+ *
+ * Fetched once per mount rather than subscribed: whether a deployment has Teams
+ * changes when a module is installed, which is a restart, not a session event.
+ */
+export function useCoreFlags() {
+  const [flags, setFlags] = useState(null)
+
+  useEffect(() => {
+    let active = true
+    fetch(TEAMS_URL, { credentials: 'same-origin' })
+      .then((res) => (res.ok ? res.json() : null))
+      .then((body) => {
+        if (!active) return
+        // A body that does not carry `enabled` is an older server or a shape
+        // change, and both are "unknown" rather than "no".
+        if (!body || typeof body.enabled !== 'boolean') return
+        setFlags(new Set(body.enabled ? ['teams'] : []))
+      })
+      .catch(() => {}) // stays null: unknown shows the row
+    return () => { active = false }
+  }, [])
+
+  return flags
+}
+
+export default useCoreFlags