feat(teams): reserved-name screening, auto-hide, and the admin-approval gate

The one place untrusted game data becomes a public page (docs/website/TEAMS.md
§2.8), and the gate on releasing it (§2.9).

A Team's name is written by a player, in the game, with no review, and this
platform turns it into a public page, a URL and eventually a Discord channel
name. Someone naming their guild "Admin" or "<Brand> Staff" gets an
official-looking page on the operator's own site for free.

Hide, never reject. Core cannot refuse a name -- the guild already exists in the
game and core is a mirror of it, not an authority over it. A match hides the Team
from public surfaces and files it in a review queue, and it keeps working
completely for its own members: their forum, their grants, their notifications.
The people in it are not being punished for a name their leader chose.

That asymmetry -- a false positive costs a human glance, a false negative costs
an impersonated staff page -- is what lets the matcher be conservative. It is not
licence to be sloppy the other way: a check that fires on "Badminton" gets
switched off, and then the real cost is paid in full. So matching is whole WORDS
after normalisation, never substrings, following the precedent
scripts/checkModuleIdentifiers.js set for exactly this reason.

Three matcher gaps found by writing the tests, all real impersonation vectors:

  - "Guild of Moderators" did not match `moderator`. Only a trailing s off the
    WHOLE term is stripped, so "Nomads" still does not match `mod`.
  - "G.M." normalises to two single-letter words and matched nothing. A run of
    two or more single-letter words is now also offered joined. Deliberately not
    a whole-name condensation, which would re-admit substring matching.
  - The multi-word condensed form was already handled and is what makes
    "RunicGateway" match the two-word term -- the form an impersonator would
    reach for, since it is what the Gitea org and every URL use.

Terms resolve at CHECK time, never baked in, so renaming a deployment protects
the new name without a redeploy. A failed settings read falls back to the static
role and project terms rather than to an empty list: screening fewer terms is
bad, screening none is the whole hole.

Re-screening runs on every reconcile, over names no human has ruled on. Names are
immutable per row, so it only ever changes an outcome when the TERM LIST changed
-- an operator adding one, or a rename -- which is exactly what a create-time-only
check would miss forever. `name_reviewed_at` is what makes a staff decision
sticky; without it an override would be undone every fifteen minutes.

The gate is scoped to three actions because they publish untrusted game-sourced
strings, and to nothing else. Ordinary forum grants, leadership overrides,
archives and forum moderation still apply immediately and are audited. A
moderator initiating one files a pending request; an admin applies at once.
Never four-eyes on admins: users.role defaults to admin and `npm run seed`
creates exactly one, so most deployments have precisely one and a second-approver
rule would wedge them with no way out.

Hiding is deliberately NOT gated. Publishing untrusted data needs a second pair
of eyes; withdrawing it needs to be possible at once, by whoever is on duty.

Two concurrency details worth the review: a decision moves the row out of
`pending` under a guard and applies its effect only if the row actually moved,
so two admins clicking approve cannot double-apply or overwrite each other's
record; and a JSON payload is parsed defensively, because the driver returns
JSON columns already parsed on some versions and as a string on others.

Screening is stubbed in the reconciler's own tests -- it is a separate unit, and
the real call reads settings, which this suite must never do against a live
database. That was caught the hard way: the suite went from 11s to hanging, and
the cause was the reconciler reaching a dead pool through the new call.

44 tests in the reconciler file (up from 39), 19 for the matcher, 25 for the
gate. Full suite 877 passed, 0 failed.

Refs docs/website/TEAMS.md §2.8, §2.9, Part 12 phase 2

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/model/teams/teamSync.model.js

@@ -31,6 +31,7 @@
 
 const teamsDb = require('./teams.db')
 const teamProvider = require('./teamProvider')
+const moderation = require('./teamModeration.model')
 const { slugify, uniqueSlug } = require('./teamSlug')
 const settings = require('../settings/settings.model')
 const log = require('../../utils/logger')('teams')
@@ -95,17 +96,23 @@ function backoffSeconds(consecutiveFailures, intervalS) {
 // ── Applying one Team ──────────────────────────────────────────────────────
 
 /**
- * Create the row for a Team core has not seen, deriving its slug.
+ * Create the row for a Team core has not seen, deriving its slug and screening
+ * its name against the reserved list (§2.8).
  *
- * Screening the name against the reserved list happens here in a later commit;
- * the row is created either way, because core cannot refuse a name — the guild
- * already exists in the game and core is a mirror of it, not an authority over it.
+ * The row is created whatever the screening says, and hidden if it matched. Core
+ * cannot refuse a name: the guild already exists in the game and core is a mirror
+ * of it, not an authority over it. A hidden Team is absent from public surfaces
+ * and completely functional for its own members — the people in it are not being
+ * punished for a name their leader chose.
  */
 async function createTeam(moduleId, team) {
   const taken = await teamsDb.slugsLike(slugify(team.name) || 'team')
   const slug = uniqueSlug(team.name, taken)
-  const id = await teamsDb.insertTeam({ moduleId, slug, ...team })
-  log.info('team created', { moduleId, externalId: team.externalId, name: team.name, slug })
+  const screened = await moderation.screenForCreate(team.name)
+  const id = await teamsDb.insertTeam({ moduleId, slug, ...team, ...screened })
+  log.info('team created', {
+    moduleId, externalId: team.externalId, name: team.name, slug, hidden: Boolean(screened.hidden),
+  })
   return id
 }
 
@@ -291,9 +298,17 @@ async function runOnce(reason) {
     }
   }
 
+  // Re-screen the names no human has ruled on. Names are immutable per row, so
+  // this only changes an outcome when the reserved TERMS changed — an operator
+  // adding one, or the deployment being renamed — which is exactly the case a
+  // create-time-only check would miss forever.
+  const rehidden = await moderation.rescreen(moduleId)
+
   await teamsDb.recordSuccess(moduleId)
-  log.info('reconcile complete', { trigger: reason, created, renamed, archived, rosters, total: answer.teams.length })
-  return { ok: true, created, renamed, archived, rosters }
+  log.info('reconcile complete', {
+    trigger: reason, created, renamed, archived, rosters, rehidden, total: answer.teams.length,
+  })
+  return { ok: true, created, renamed, archived, rosters, rehidden }
 }
 
 // ── The public entry points ────────────────────────────────────────────────