Data synchronization

Added

• Safe server handoff: a server now waits for the previous owner's final save before loading a player, retries failed quit-saves, and warns the next server when a save was lost.
• Data integrity checks: stored player data is stamped with a checksum, schema version, and owner. Damaged rows are quarantined and never loaded or overwritten. New /ds verify <player>.
• Recovery safety nets: restore, reset, purge, move, and import save what they are about to destroy first and refuse to run if that fails. Archives can be re-imported with /ds import recovery/<file>.
• /ds drain [server] [--kick] [--stop]: refuses new joins, optionally removes players, reports when the server is safe to stop, and can stop it automatically. Includes status and cancel.
• New datasync.command.drain and datasync.drain.bypass permissions, SERVER_DRAIN webhook event, and configurable shutdown: deadlines.

Fixed

• A failed or unfinished load no longer lets a later save overwrite the player's real data. Failed sessions keep their progress as a pinned history snapshot instead.
• Failed quit-saves are no longer logged as successful.
• Shutdown now drains the save queue before closing connections and releasing sessions, so queued saves are written instead of failed.
• Saves lost at shutdown are reported by player name, in the audit log and via webhook.