fix(shard): stop an undecryptable uo-link token 500ing every live-shard route

`uoLinkClient.call()` resolved the uo-link config OUTSIDE its try/catch.
resolveConfig() decrypts the stored auth token, and secretBox.decrypt throws
when the ciphertext can't be authenticated — SECRET_ENC_KEY rotated, or a DB
dump restored into an environment keyed differently. That throw escaped the
client entirely, breaking its documented "never throws / always returns
{ ok, data, status }" contract and turning a misconfiguration into a 500 on
every route that does a live sidecar round-trip:

  GET /admin/uo-link/config
  GET /{admin,player}/shard/char/:serial
  GET /{admin,player}/shard/roster/:account
  GET /{admin,player}/shard/vendors/:account

Found by a live smoke test of all 200 routes at every access level. Public
shard routes were unaffected because they read the DB via getSafe(), which
never decrypts.

Move resolveConfig() inside the try so the failure returns the standard
{ ok: false } shape, and log it at ERROR with a distinct message: a wrong key
previously looked identical to "the shard is offline", with no clue why.
Those routes now degrade to 503, and GET /admin/uo-link/config returns 200
again — it is the screen an admin needs to re-enter the token and recover, so
having it 500 locked them out of the fix.

Also gate the admin Dashboard's site-mode toggle. PUT /admin/site-mode is
adminOnly, but the button rendered for every staff role, and toggle() had a
try/finally with no catch — so an editor clicking it got an unhandled promise
rejection and zero UI feedback. Gate the control on role === 'admin' (the rule
AdminLayout already documents: never show a non-admin a control that would 403)
and surface a message if the call is refused anyway.

Adds server/test/uoLinkClient.test.js, which fails against the unfixed client.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/utils/uoLinkClient.js

@@ -40,14 +40,22 @@ function invalidateConfig() {
 // with a parseable JSON body. Non-2xx responses still return their status + body
 // so callers can distinguish 503 (shard restarting — transient) from 404.
 async function call(path, { method = 'GET', body } = {}) {
-  const config = await resolveConfig()
-  if (!config || !config.baseUrl) {
-    return { ok: false, status: 0, error: 'uo-link is not configured' }
-  }
-
   const controller = new AbortController()
   const timeout = setTimeout(() => controller.abort(), TIMEOUT_MS)
+  // resolveConfig() decrypts the stored auth token, and decryption THROWS when the
+  // ciphertext can't be authenticated — SECRET_ENC_KEY was rotated, or a DB dump was
+  // restored into an environment keyed differently. It must stay INSIDE the try: out
+  // here it escaped `call()` entirely and 500'd every live-shard route (admin and
+  // player character/roster/vendor lookups, GET /admin/uo-link/config) instead of
+  // degrading to "shard unavailable". This module never throws — see the header.
+  let configResolved = false
   try {
+    const config = await resolveConfig()
+    configResolved = true
+    if (!config || !config.baseUrl) {
+      return { ok: false, status: 0, error: 'uo-link is not configured' }
+    }
+
     const headers = {
       'Content-Type': 'application/json',
       'X-UOLink-Version': String(config.protocol || 1),
@@ -75,6 +83,16 @@ async function call(path, { method = 'GET', body } = {}) {
     }
     return { ok: true, status: res.status, data }
   } catch (err) {
+    // A failure before the config resolved is a misconfiguration, not a flaky
+    // sidecar: log it loudly (and distinctly) so "the shard looks offline" doesn't
+    // silently mean "the token can no longer be decrypted".
+    if (!configResolved) {
+      log.error('uo-link config unreadable — is SECRET_ENC_KEY the key the stored token was encrypted with?', {
+        path,
+        message: err.message,
+      })
+      return { ok: false, status: 0, error: 'uo-link config unreadable' }
+    }
     log.warn('uo-link call failed', { path, message: err.message })
     return { ok: false, status: 0, error: err.message }
   } finally {