GroupVerify: Verification page, overrides and public Verified tags

Shown only where GroupVerify is: staff get the Verification page once its gv_* tables are in
the database, and the public site shows "Verified" only while it's on (enabled, with a group)
and not missing from css_plugins list, which the poller reads once a minute over RCON.

- Verification page: plugin state and version, Steam group, saved member list, overrides.
- Overrides (@zio/verify, not on yourself unless Root): give, change, remove; player drawer
  shows why a player is or isn't verified.
- Root sets the group and turns it on/off: saved to gv_settings, and sent as css_gv_* when the
  plugin is loaded so it applies at once.
- gv_* times use GroupVerify's own timezone setting.
- MySQL integration test (SAW_TEST_DSN), unit tests for plugin list parsing and the show rule.

internal/web/admin.go

@@ -35,6 +35,7 @@ func nonNil[T any](v []T) []T {
 func (s *Server) adminOverview(w http.ResponseWriter, r *http.Request, id *Identity, x *staffIndex) {
 	ctx := r.Context()
 	view := s.serverView(x, s.poll.Current())
+	s.markVerified(ctx, view.Players)
 
 	var ids []string
 	for _, p := range view.Players {
@@ -238,6 +239,12 @@ func (s *Server) adminPlayer(w http.ResponseWriter, r *http.Request, id *Identit
 		resp["groups"] = a.Groups
 		resp["adminEnds"] = a.Ends
 	}
+	if v, err := s.playerVerify(ctx, id, steamid); err != nil {
+		internal(w, r, err)
+		return
+	} else if v != nil {
+		resp["verify"] = v
+	}
 	writeJSON(w, http.StatusOK, resp)
 }
 
@@ -299,6 +306,7 @@ var knownFlags = [][3]string{
 	{"@zio/vote", "Start votes", "css_vote"},
 	{"@zio/plugins", "Plugins", "css_plugins and css"},
 	{"@zio/webpanel", "Staff page", "See the Staff & ranks page in this panel"},
+	{"@zio/verify", "Verification overrides", "Give and remove GroupVerify overrides in this panel"},
 	{"@css/root", "Root", "Every permission, and managing ranks and staff"},
 }