feat(shard): admin-configurable visibility for every shard surface

Protocol 3.0 Part A. Replaces the static PUBLIC_KINDS allowlist - which
was the entire public/admin boundary - with per-feature, per-field
audience control an admin owns from Admin -> Shard Visibility.

Closes a live leak. BridgeJson.Actor() writes acct and webId;
shapeGuild() returned the stored payload verbatim; GET
/api/v1/public/shard/guilds is anonymous. Guild leaders' game account
names and website user ids were readable by anyone, and the same path
existed for governors. Both are now projected.

The ladder is anonymous < logged_in < player < staff < admin, each rung
implying the ones below. Staff satisfy `player` without a linked account
(as /player/* already does); `editor` is a content role and gets no
shard privilege, since mapping it to staff would silently widen what
editors see.

Two invariants are code, not configuration, and both reject rather than
silently ignore:

  1. acct/webId are admin-only always - not configurable, discarded on
     read as well as rejected on write.
  2. A kind absent from KIND_FEATURE never reaches anyone below admin.
     Fail closed, so a shard emitting a new event degrades to staff-only
     rather than to public.

Enforcement is three points over one config: requireFeature() on routes
(404 disabled, 403 out-of-rung) plus field projection; per-connection
filtering on SSE, where a subscriber's rung is resolved once at subscribe
time and frozen so a long-open stream cannot gain privilege; and
/public/shard/features so the SPA hides links it cannot follow.

PUBLIC_KINDS still exists and is still exported (/feed filtering,
notificationStreams) but is now derived from the kind map, so the two
can no longer drift. Defaults reproduce pre-3.0 behavior exactly - a
test pins the derived set against the old allowlist.

Also fixes an SSE resource leak found while testing: a client dropped
because its write threw was removed from the bucket but its keepalive
interval was never cleared, firing forever on a dead socket. Both paths
now go through one drop().

Tests: 478 server (33 new across shardVisibility + shardBroadcast),
43 client. Route manifest and OpenAPI spec regenerated.

Co-Authored-By: Claude <noreply@anthropic.com>

server/swagger/swagger.js

@@ -881,6 +881,78 @@ const doc = {
           updatedAt: { type: 'string', format: 'date-time' },
         },
       },
+      ShardFeatures: {
+        type: 'object',
+        description:
+          "The shard features the caller may reach, plus the audience rung they resolved to. Drives client nav so it never renders a link that would 403.",
+        properties: {
+          level: {
+            type: 'string',
+            enum: ['anonymous', 'logged_in', 'player', 'staff', 'admin'],
+            example: 'anonymous',
+          },
+          features: {
+            type: 'array',
+            items: { type: 'string' },
+            example: ['status', 'activity', 'champs', 'guilds', 'governors', 'houses', 'presence'],
+          },
+        },
+      },
+      ShardFeatureVisibility: {
+        type: 'object',
+        description: 'Visibility settings for one shard feature.',
+        properties: {
+          enabled: { type: 'boolean', example: true },
+          audience: {
+            type: 'string',
+            enum: ['anonymous', 'logged_in', 'player', 'staff', 'admin'],
+            description: 'Minimum rung that may reach this feature. Each rung implies the ones below it.',
+            example: 'anonymous',
+          },
+          stream: {
+            type: 'boolean',
+            description: "Whether this feature's event kinds fan out over SSE at all.",
+            example: true,
+          },
+          fieldRules: {
+            type: 'object',
+            additionalProperties: { type: 'string' },
+            description:
+              'Per-field rung overrides for the sensitive fields this feature exposes. acct / webId are admin-only always and are rejected here.',
+            example: { location: 'staff' },
+          },
+        },
+      },
+      ShardVisibilityConfig: {
+        type: 'object',
+        properties: {
+          ladder: {
+            type: 'array',
+            items: { type: 'string' },
+            example: ['anonymous', 'logged_in', 'player', 'staff', 'admin'],
+          },
+          lockedFields: { type: 'array', items: { type: 'string' }, example: ['acct', 'webId'] },
+          defaults: {
+            type: 'object',
+            additionalProperties: { $ref: '#/components/schemas/ShardFeatureVisibility' },
+          },
+          features: {
+            type: 'object',
+            additionalProperties: { $ref: '#/components/schemas/ShardFeatureVisibility' },
+          },
+        },
+      },
+      ShardVisibilityUpdate: {
+        type: 'object',
+        required: ['features'],
+        properties: {
+          features: {
+            type: 'object',
+            additionalProperties: { $ref: '#/components/schemas/ShardFeatureVisibility' },
+            example: { market: { enabled: true, audience: 'player', stream: false, fieldRules: { ownerName: 'player' } } },
+          },
+        },
+      },
       ShardLinkRequest: {
         type: 'object',
         required: ['code'],