docs(safety): record USER_SAFETY step 4, the app's chat-line menu

§4.3 rewritten to match what was built: the long-press sheet and what it
offers, the refusals, the re-read after a change, the Hidden by staff marker,
and Account -> Blocked. §7 step 4 recorded as built and walked on the
emulator, with the two things the walk found. android/PLAN.md M8 step 4
points at it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

android/PLAN.md

@@ -1062,7 +1062,8 @@ push, and Play (M6–M8) follow the designed app.
       and it takes `MODULE_API` 1.20.0 (org lead, 2026-10-29). The app's part, the *Delete my
       account* screen reached from *My account*, was built 2026-10-30 (that plan's §6 step 4).
    4. **Report, block and hide** across `website`, `Module-Rust`, the kit and this app
-      (`USER_SAFETY.md` §7), now `MODULE_API` 1.21.0.
+      (`USER_SAFETY.md` §7), now `MODULE_API` 1.21.0. The app's part, a long-press menu on Rust
+      chat lines and *Account → Blocked*, was built 2026-10-30 (that plan's §7 step 4).
    5. **The cutover**, `edge` → `main`, once 1-4 have landed, so the first Play bundle carries
       all of it. **Before it merges, the org lead enrolls the existing keystore as the app-signing
       key** in Play Console (App integrity, "use my own key"). `PLAY_SERVICE_ACCOUNT_JSON` is