test: re-point core's suite at what core still owns

25 of 82 test files left with the module. Three that core keeps needed splitting
rather than moving, and the split is the boundary in each case.

announceJobs.test.js keeps the announce PIPELINE -- the shared backoff schedule,
the parent-status rollup, core's Discord leg -- and loses the town-crier text
building and classification, which are a module's leg. pushDispatch.test.js
keeps the SSRF guard and publish() delivering a content-free tickle, and loses
mapShardEvent and the shard fan-out, which are a module's catalog.

playerRouteAccess.test.js is the one worth explaining. It guards a real past bug
-- an admin 403'd off their own characters -- and it did so through
/player/shard/accounts, which is now module-owned. The guarantee it protects is
CORE's, though: /player/* is role-agnostic self-service, staff are a superset of
players. So it stays here and asserts that through /player/appeals, a core route
with the same gate. Moving it would have left core with no test of its own tier
rule, which is precisely what regressed once before.

The remaining updates are core's own tests catching up: ctx has four more
members, registerCore now registers only what core owns (one stream, one leg, no
filled slot), and the extension-slot test asks for the DECLARED slot's router
rather than the filled one, since core declares it and a module fills it. The
gated-surface floor drops from >100 to >50 -- it is there so a filter matching
nothing fails loudly, not to track core's exact route count.

616 core tests and 160 client tests pass; the module's own suite is 351.

Co-Authored-By: Claude <noreply@anthropic.com>

server/test/routeManifest.test.js

@@ -59,7 +59,11 @@ test('every /admin, /player and /settings route still sits behind the shared aut
   // unambiguous.
   const AUTHENTICATED_GROUPS = ['/api/v1/admin/', '/api/v1/player/', '/api/v1/settings/']
   const gated = collected.public.filter((r) => AUTHENTICATED_GROUPS.some((p) => r.path.startsWith(p)))
-  assert.ok(gated.length > 100, 'expected the gated surface to be found')
+  // A floor, not a count: it exists so a filter that silently matches nothing
+  // fails loudly rather than passing vacuously. It was >100 before Phase 3 moved
+  // 70 UO routes into module-uo, and there is no value in tracking core's exact
+  // total here — the per-route assertion below is what actually guards the gate.
+  assert.ok(gated.length > 50, 'expected the gated surface to be found')
   for (const route of gated) {
     assert.ok(
       route.gates.includes('requireAuth'),