Store SCUM facts in typed platform tables

Run pushes typed SCUM facts through POST /api/v1/run/scum/facts, but the
production router rejected that path before the signature middleware because
runServiceRequest listed individual Run channel prefixes, and MySQL kept SCUM
rows inside the whole metadata snapshot instead of platform tables.

- /api/v1/run/ is now the signed machine channel space while
  /api/v1/run/endpoints keeps normal bearer/admin authorization.
- MySQL gets real scum_user, scum_user_trajectory, scum_vehicle,
  scum_vehicle_trajectory and scum_vehicle_lock tables with parameterized
  per-row repositories instead of full snapshot rewrites. Snapshot-shaped
  tables from the unreleased interim build are replaced, and SCUM rows still
  inside a metadata snapshot are migrated once.
- Facts ingest verifies the target server plugin type and converges stale
  online users to offline after SCUMUserOfflineAfter.
- The plugin page and browser read one bounded /scum/surface response instead
  of five list calls per refresh.

Call-count budget for one server: per 5s facts batch, one SELECT plus one
INSERT/UPDATE per reported user and vehicle, one INSERT per moved trajectory
sample or new lock row, one bounded stale-user SELECT, and a trajectory
retention DELETE at most once per hour. One browser refresh issues one surface
request every 15s instead of five list requests.

platform_web/api/client.ts

@@ -89,6 +89,7 @@ import type {
   ServerMetricsListResponse,
   ScumListRequest,
   ScumUserListResponse,
+  ScumSurfaceResponse,
   ScumUserTrajectoryListResponse,
   ScumVehicleLockListResponse,
   ScumVehicleListResponse,
@@ -537,6 +538,10 @@ export class PlatformApiClient {
     return this.request<ScumVehicleLockListResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/vehicle-locks${scumListQuery(request)}`);
   }
 
+  async getScumSurface(serverInstanceId: string): Promise<ScumSurfaceResponse> {
+    return this.request<ScumSurfaceResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/surface`);
+  }
+
   async listPluginData(serverInstanceId: string, collection: string, key?: string): Promise<{ items: Array<{ key: string; value: Record<string, unknown> }>; count: number }> {
     const params = new URLSearchParams();
     if (key) params.set("key", key);

platform_web/api/types.ts

@@ -192,6 +192,7 @@ export interface ScumUserResponse {
 }
 
 export interface ScumUserListResponse { items: ScumUserResponse[]; count: number; }
+export interface ScumSurfaceResponse { users: ScumUserListResponse; vehicles: ScumVehicleListResponse; userTrajectories: ScumUserTrajectoryListResponse; vehicleTrajectories: ScumVehicleTrajectoryListResponse; vehicleLocks: ScumVehicleLockListResponse; }
 
 export interface ScumUserTrajectoryResponse {
   id: string;

platform_web/contracts/pluginPageHost.ts

@@ -1,5 +1,5 @@
 import type { PluginBridgeExecuteEnvelope, PluginBridgeExecutionResult } from "./pluginBridge";
-import type { GameClientBridgeCommandFilterRequest, GameClientBridgeQueueRequest, GameClientBridgeSnapshotQuery, LogStreamCursorRequest, LogStreamCursorResponse, LogStreamListResponse, ScumListRequest, ScumUserListResponse, ScumUserTrajectoryListResponse, ScumVehicleLockListResponse, ScumVehicleListResponse, ScumVehicleTrajectoryListResponse } from "../api/types";
+import type { GameClientBridgeCommandFilterRequest, GameClientBridgeQueueRequest, GameClientBridgeSnapshotQuery, LogStreamCursorRequest, LogStreamCursorResponse, LogStreamListResponse, ScumListRequest, ScumSurfaceResponse, ScumUserListResponse, ScumUserTrajectoryListResponse, ScumVehicleLockListResponse, ScumVehicleListResponse, ScumVehicleTrajectoryListResponse } from "../api/types";
 
 export interface PluginDataMutation {
   operation: "put" | "delete";
@@ -25,6 +25,7 @@ export interface PluginPageWorkspaceActions {
     query: (request: LogStreamCursorRequest) => Promise<LogStreamCursorResponse>;
   };
   scum?: {
+    surface: () => Promise<ScumSurfaceResponse>;
     users: (request?: ScumListRequest) => Promise<ScumUserListResponse>;
     userTrajectories: (request?: ScumListRequest) => Promise<ScumUserTrajectoryListResponse>;
     vehicles: (request?: ScumListRequest) => Promise<ScumVehicleListResponse>;

platform_web/pages/PluginPageHostPage.tsx

@@ -94,6 +94,7 @@ export function PluginPageHostPage({ params, onNavigate, initialPlugin, embedded
         }
       },
       scum: {
+        surface: () => platformApiClient.getScumSurface(serverId),
         users: (request) => platformApiClient.listScumUsers(serverId, request),
         userTrajectories: (request) => platformApiClient.listScumUserTrajectories(serverId, request),
         vehicles: (request) => platformApiClient.listScumVehicles(serverId, request),