feat(protection): implement player opt-in lifecycle

design/log.md

@@ -27,3 +27,10 @@
 - Added defensive UUID-keyed YAML player state with RFC 3339 timestamps, forward-field preservation, and atomic replacement where supported.
 - Added safe plugin initialization and periodic dirty-state persistence.
 - US-006 remains in progress pending live runtime setting commands and Leaf effect ownership behavior.
+
+### US-001 player protection completed
+
+- Added permission-aware player commands with idempotent choice changes and detailed status reporting.
+- Added immediate durable opt-in persistence, join-time restoration, and quiet infinite Resistance reconciliation.
+- Leaf tracks its live Resistance fingerprint and conservatively preserves a visibly distinct Resistance effect.
+- Verified player choice, lock, persistence, command, autocomplete, and build behavior with `./gradlew clean check jar`.

design/user-stories/us-001-opt-into-leaf-protection.md

@@ -2,7 +2,7 @@
 type: User Story
 title: "US-001: Opt into Leaf protection"
 description: Let players voluntarily receive and relinquish a persistent Resistance boost.
-status: backlog
+status: done
 ---
 
 # US-001: Opt into Leaf protection
@@ -11,15 +11,15 @@ As a **player**, I want to opt into Leaf protection so that I can receive a mode
 
 ## Acceptance criteria
 
-- [ ] Players with the `leaf.use` permission, granted by default, can use `/leaf on`, `/leaf off`, and `/leaf status`.
-- [ ] `/leaf on` records the player's opt-in choice and grants Resistance I while Leaf is globally enabled.
-- [ ] Resistance remains continuously effective without distracting expiry or renewal messages or particles.
-- [ ] `/leaf off` records the player's opt-out choice and immediately removes only the Resistance effect managed by Leaf.
-- [ ] `/leaf status` clearly distinguishes the player's saved choice, active protection, administrative lock, and global Leaf state.
-- [ ] Repeating an already-satisfied `on` or `off` command is safe and explains that no change was needed.
-- [ ] Opt-in choices are keyed by UUID and survive logout and server restart.
-- [ ] A player who joins while opted in regains protection when Leaf is enabled.
-- [ ] Player-command autocomplete suggests only valid next arguments available to the sender.
+- [x] Players with the `leaf.use` permission, granted by default, can use `/leaf on`, `/leaf off`, and `/leaf status`.
+- [x] `/leaf on` records the player's opt-in choice and grants Resistance I while Leaf is globally enabled.
+- [x] Resistance remains continuously effective without distracting expiry or renewal messages or particles.
+- [x] `/leaf off` records the player's opt-out choice and immediately removes only the Resistance effect managed by Leaf.
+- [x] `/leaf status` clearly distinguishes the player's saved choice, active protection, administrative lock, and global Leaf state.
+- [x] Repeating an already-satisfied `on` or `off` command is safe and explains that no change was needed.
+- [x] Opt-in choices are keyed by UUID and survive logout and server restart.
+- [x] A player who joins while opted in regains protection when Leaf is enabled.
+- [x] Player-command autocomplete suggests only valid next arguments available to the sender.
 
 ## Related