feat: let guests publish a CommunityRule and claim it on this browser later

Finalize no longer requires a magic link. Guest rows stay off the catalog until sign-in on the same browser attaches ownership, and the login modal kebab no longer acts as a second close.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/unit/hashRuleClaimToken.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { hashRuleClaimToken, hashSessionToken } from "../../lib/server/hash";
+
+describe("hashRuleClaimToken", () => {
+  it("is stable for the same token and pepper", () => {
+    const a = hashRuleClaimToken("secret-token", "pepper");
+    const b = hashRuleClaimToken("secret-token", "pepper");
+    expect(a).toBe(b);
+    expect(a).toMatch(/^[a-f0-9]{64}$/);
+  });
+
+  it("differs from the session hash of the same token", () => {
+    const claim = hashRuleClaimToken("secret-token", "pepper");
+    const session = hashSessionToken("secret-token", "pepper");
+    expect(claim).not.toBe(session);
+  });
+});