feat: download worlds as single-player saves

[thomasmny]

What

Adds /worlds download <world>, which packs a world into a single-player save and hands the player an expiring link to fetch it. Since Paper 26.1 a world is a dimension of the main level, so its folder on its own is not something a client can open — the export rebuilds the save layout around it.

Two unrelated fixes ride along, both found while working here: /worlds setItem now keeps a held skull's texture, and head profiles Mojang does not know (offline-mode UUIDs) no longer log a warning per menu item.

The export

A dimension world has no level.dat, its chunks sit under the wrong dimension, and Paper keeps a per-world copy of the level-scoped data inside the dimension folder while a save keeps one set at the root. The export splits it by scope, following the layout documented for 26.1+:

<world>/
├── level.dat                          the main level's, renamed and stripped of server metadata
├── data/minecraft/                    world_gen_settings, game_rules, weather, …
└── dimensions/minecraft/overworld/
    ├── region/  entities/  poi/
    └── data/minecraft/                raids, world_border, chunk_tickets

A world still in the pre-26.1 flat layout is already a save: only its level.dat is rewritten, and dimensions belonging to other worlds are dropped.

The world is saved with the chunk writer flushed first. World#save() returns while Paper is still writing region files, so both this and existing backups could archive half-written chunks — BackupProfileImpl had the same bug and is fixed too. Paper's save(boolean flush) is resolved reflectively, since this module compiles against spigot-api; Spigot writes chunks synchronously, so its fallback is already flushed.

Security

Off by default: enabling it opens a port that serves world data.

• The URL path is a random 256-bit token. A request can never name a file, so nothing outside plugins/BuildSystem/downloads is reachable.
• A link is pinned to the first client that uses it; forwarding it is useless, retry and resume still work.
• 30 requests/minute per address (429), capped concurrent transfers (503 + Retry-After), per-archive size limit and a shared storage budget.
• Archives die with their token: on expiry, on reload, on shutdown, and leftovers are wiped at startup.
• Exports never include player data (players/, playerdata/, stats/, advancements/), so downloading the main world does not hand out the server's inventories. level.dat also loses the server brand, version and server-side datapacks.
• Plain HTTP: no TLS in the plugin, since a keystore would need managing and reloading on every certificate renewal. url points at a reverse proxy instead, and startup warns while it is not https://.

Config

world:
  download:
    enabled: false
    port: 8080
    url: "http://localhost:8080"
    expiration-minutes: 30
    max-size-mb: 2048
    max-storage-mb: 8192
    max-concurrent-downloads: 3

buildsystem.download, default OP, supports .self / .other. New keys are added to an existing config.yml automatically; no migration needed.

Tests

WorldExporterTest covers both layouts, the scope split, the level.dat rename, progress reporting and the progress bar; DownloadRegistryTest covers link pinning, expiry, purging and the rate limiter. Exports were also verified against a real 26.2 server world: layout, no player data, no foreign dimensions, DataPacks.Enabled: ["vanilla"].

Not verified

Loading an exported save in a 26.2 client. The layout matches the documented format and a real server world, but no client on this machine could open it. Worth one manual check before merging.

Docs: thomasmny/buildsystem-docs@v4.