test: re-point core's suite at what core still owns

25 of 82 test files left with the module. Three that core keeps needed splitting
rather than moving, and the split is the boundary in each case.

announceJobs.test.js keeps the announce PIPELINE -- the shared backoff schedule,
the parent-status rollup, core's Discord leg -- and loses the town-crier text
building and classification, which are a module's leg. pushDispatch.test.js
keeps the SSRF guard and publish() delivering a content-free tickle, and loses
mapShardEvent and the shard fan-out, which are a module's catalog.

playerRouteAccess.test.js is the one worth explaining. It guards a real past bug
-- an admin 403'd off their own characters -- and it did so through
/player/shard/accounts, which is now module-owned. The guarantee it protects is
CORE's, though: /player/* is role-agnostic self-service, staff are a superset of
players. So it stays here and asserts that through /player/appeals, a core route
with the same gate. Moving it would have left core with no test of its own tier
rule, which is precisely what regressed once before.

The remaining updates are core's own tests catching up: ctx has four more
members, registerCore now registers only what core owns (one stream, one leg, no
filled slot), and the extension-slot test asks for the DECLARED slot's router
rather than the filled one, since core declares it and a module fills it. The
gated-surface floor drops from >100 to >50 -- it is there so a filter matching
nothing fails loudly, not to track core's exact route count.

616 core tests and 160 client tests pass; the module's own suite is 351.

Co-Authored-By: Claude <noreply@anthropic.com>

server/test/moduleLoader.test.js

@@ -503,11 +503,22 @@ test('ctx exposes exactly the documented surface, and is frozen', () => {
   assert.equal(stateOf(freshLoader(tmpRoot), 'probe').state, 'registered')
 
   const probe = JSON.parse(fs.readFileSync(seen, 'utf8'))
+  // API 1.1.0 added activity, users and site — each because module-uo's
+  // extraction needed it and none could be vendored: an admin action a module
+  // performs belongs in core's one audit log, the extension slot needs the user
+  // its prefix names, and §2.7 forbids a module reading core's APP_BASE_URL.
   assert.deepEqual(probe.keys, [
-    'auth', 'db', 'express', 'log', 'middleware', 'moduleId', 'paths',
-    'posts', 'push', 'secretBox', 'settings', 'uploads', 'validator',
+    'activity', 'auth', 'db', 'express', 'log', 'middleware', 'moduleId', 'paths',
+    'posts', 'push', 'secretBox', 'settings', 'site', 'uploads', 'users', 'validator',
+  ])
+  //  is core's limiter FACTORY, not a limiter: a module states its own
+  // window and cap and takes the plumbing, so there is one express-rate-limit in
+  // the process and one place a breach is logged.  is
+  // handed over whole because it is shared policy — core's /auth/me and
+  // /player/account sit behind the same counter.
+  assert.deepEqual(probe.middleware, [
+    'accountChangeLimiter', 'noindex', 'rateLimit', 'requireAuth', 'requireRole', 'siteMode', 'validate',
   ])
-  assert.deepEqual(probe.middleware, ['noindex', 'requireAuth', 'requireRole', 'siteMode', 'validate'])
   assert.equal(probe.moduleId, 'probe')
   assert.equal(probe.mutable, false, 'ctx members must be frozen')
 })