feat: let guests publish a CommunityRule and claim it on this browser later

Finalize no longer requires a magic link. Guest rows stay off the catalog until sign-in on the same browser attaches ownership, and the login modal kebab no longer acts as a second close.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/server/hash.ts

@@ -8,6 +8,11 @@ export function hashSessionToken(token: string, pepper: string): string {
   return sha256Hex(`${pepper}:session:${token}`);
 }
 
+/** Guest-publish claim secret; prefix is distinct from session hashes. */
+export function hashRuleClaimToken(token: string, pepper: string): string {
+  return sha256Hex(`${pepper}:rule-claim:${token}`);
+}
+
 export function newSessionToken(): string {
   return randomBytes(32).toString("base64url");
 }