spike(modules): carry /public/atlas/* behind the proposed module surface

THROWAWAY BRANCH — evidence for the Phase 1 contract, never merged. See
modules/uo/SPIKE.md and docs/website/MODULE_API.md Part 7.

The six public spawn-atlas routes now live in modules/uo/, reached only through
the ctx/register surface, with the client half loading as a prebuilt ESM chunk.
All three exit criteria met:

  • zero internal-file imports from the module into core; the built chunk has
    zero bare import specifiers and bundles no React
  • routes.manifest.json AND routes.guards.json are byte-identical
  • /uo/atlas renders from /modules/uo/entry.js under script-src 'self' with
    zero CSP violation reports

729 core tests and 81 module tests pass. Verified end to end against the real
database: the schema fragment replays after core's, onBoot runs the atlas
refresh, and the six API URLs answer unchanged.

Two things the spike changed in the contract:

  • ctx.express / ctx.validator. A module lives outside server/, so Node never
    reaches server/node_modules and require('express') fails outright — the
    server-side twin of the one-React rule, which §2.6 had only for the client.
  • window.__rg.jsxRuntime, so a module can build with the automatic JSX
    runtime its tooling already assumes rather than being forced to classic.

And it confirmed §6.1 empirically: regenerating the OpenAPI spec silently
deleted all 361 lines of the atlas paths with "Swagger-autogen: Success", while
the route manifest kept all six in the same run. That is exactly the
static-analysis-vs-runtime split the fragment merge exists to prevent.

Co-Authored-By: Claude <noreply@anthropic.com>

modules/uo/server/db/purge.sql

@@ -0,0 +1,21 @@
+-- ── module-uo · purge ──────────────────────────────────────────────────────
+--
+-- DESTRUCTIVE. Run ONLY by the explicit admin purge action, never by uninstall
+-- (docs/website/MODULE_API.md §2.6) — uninstalling a module removes its code and
+-- retains its data, and an operator who wants the data gone has to say so.
+--
+-- Required because this module declares a schema fragment: a module that can
+-- create tables and cannot drop them leaves an operator with orphaned data and
+-- no supported way to remove it.
+--
+-- Dropped children-first even though these tables carry no foreign keys, so the
+-- order stays correct if Phase 3 adds one.
+
+DROP TABLE IF EXISTS shard_atlas_pending;
+DROP TABLE IF EXISTS shard_atlas_meta;
+DROP TABLE IF EXISTS shard_champion_spawns;
+DROP TABLE IF EXISTS shard_landmarks;
+DROP TABLE IF EXISTS shard_regions;
+DROP TABLE IF EXISTS shard_spawn_point_types;
+DROP TABLE IF EXISTS shard_spawn_points;
+DROP TABLE IF EXISTS shard_spawn_creatures;