Add the exp_reports plugin and move the scenario onto it

[bbassie]

Reports were the last legacy control module, kept in each instance's lua state. This replaces them with an exp_reports plugin along the lines you described: reports are immutable and hold the player, who reported them, the reason, the instance name and when it was made; the only operations are get, list, create and delete (ReportGetRequest, ReportListRequest with an optional player, ReportCreateRequest, ReportDeleteRequest), and ReportUpdatedEvent feeds the web ui. The controller keeps them in a SubscribableDatastore (database/exp_reports/reports.json), allows one report per reporter per player, and for web created reports takes the reporter from the connection's user rather than the request.

Nothing is stored in game. The lua module (modules/exp_reports) sends exp_reports:create|list|delete over ipc, the instance plugin asks the controller and hands the answer back with rcon (receive_created, receive_list, receive_deleted, receive_error), and the module prints it to whoever asked if they are still online. Answers are dropped when the instance is no longer running. Because the jail check needs the other reports, the create path also fetches the reports against the player and raises on_player_reported with report_count and by_player_names; report_jail, discord_alerts, the report commands and the player list button now go through the module, and the response strings moved into the module's own locale ([exp-reports], en/zh-CN/zh-TW).

The web ui gets a /reports page (permission exp_reports.report.list): a table with column search on player, reporter and reason (via useColumnSearch/useTableQueryState), an instance filter, time sort, delete per row behind exp_reports.report.delete, and a create form behind exp_reports.report.create which reports in the name of the web user.

Two optional controller config fields, exp_reports.discord_webhook_url and exp_reports.json_webhook_url, receive every new report: the Discord one as an embed with player, reporter, instance and reason, the JSON one as { "type": "report_created", "report": {...} }. Webhook failures are logged and never fail the report.

Tests (pnpm --filter @expcluster/reports test, 79 assertions): message round trips, the controller against a real Controller with an InstanceRecord and a fake control connection (instance vs web reporter, duplicate and empty reason refusals, list/get/delete, subscription replay, webhooks posted only for new reports, failed posts logged), the instance plugin against a real Instance (each ipc path, a controller refusal reaching the reporter, answers dropped after stop), and the lua module through the shared harness (payloads sent, every receiver's printing and events, offline players skipped). Lua lint is clean.

Smoke tested on my dev cluster: a report created from the web path came back with the connected user as reporter and no instance; one created from lua over rcon came back with instance_name: "EXP"; a local node http server on the JSON webhook received the record; the lua delete path removed both. The in game printing and the web page itself need a player and a browser, which I do not have here.

One thing to weigh: the reporter's own commands are still in exp_scenario with their existing permissions, only the storage and printing moved. If you would rather the commands live in the plugin too, that is a small follow up.