feat(safety): report, block and hide, MODULE_API 1.21.0

USER_SAFETY.md step 2 (core), with S11-S14 decided while building it.

- Reports: POST /player/reports takes any target type, core's forum
  types or a module's registered ones. One resolver
  (model/safety/targets.js) answers "what is this item, for this
  reader" and 404s an item the reader cannot see. Every report stores
  content_reports.snapshot; the queue shows a module item from it.
- Hide for everyone: POST /admin/moderation/reports/:id/hide hides the
  item through its own moderation (forum hide as staff, or the module's
  hide) and actions the report with actioned_with = 'hide'.
- Blocks (user_blocks) name an item, never a person, and land on the
  author's account first (S12); an unlinked game identity is blocked as
  itself and becomes an account block once linked (S14). Staff cannot
  be blocked; a block on someone later promoted stops applying (S8).
- Hide for me (user_hidden_items), /auth/me/blocks and /auth/me/hidden.
- Forum reads filter blocked authors and hidden items on the server and
  carry canBlock per thread and post.
- MODULE_API 1.21.0: api.registerReportTargets,
  api.registerGameIdentities, ctx.safety.forViewer and
  ctx.safety.staffAmong, so a module filters its own per-viewer feeds on
  the server (S11) and marks lines canBlock (S13).
- Web: Hide for me / Block author in the forum menus, a Blocked section
  on both account pages, Hide for everyone in the Reports queue.
- Tests, OpenAPI, route/guard/engagement manifests regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

client/src/api/client.js

@@ -154,6 +154,20 @@ export const api = {
   generateRecoveryCodes: (currentPassword) =>
     req('/auth/me/account/recovery-codes/generate', { method: 'POST', body: { currentPassword } }),
 
+  // Report, block and "Hide for me" (USER_SAFETY.md §4.1). A block and a report
+  // name an ITEM — `{ targetType, targetId }` — never a person: the server reads
+  // who wrote it. Saved on the account, so they apply on every device.
+  reportItem: ({ targetType, targetId, reason, detail }) =>
+    req('/player/reports', { method: 'POST', body: { targetType, targetId, reason, detail } }),
+  myBlocks: () => req('/auth/me/blocks'),
+  blockAuthor: ({ targetType, targetId }) => req('/auth/me/blocks', { method: 'POST', body: { targetType, targetId } }),
+  unblock: (id) => req(`/auth/me/blocks/${encodeURIComponent(id)}`, { method: 'DELETE' }),
+  myHidden: () => req('/auth/me/hidden'),
+  hideItem: ({ targetType, targetId }) => req('/auth/me/hidden', { method: 'POST', body: { targetType, targetId } }),
+  unhideItem: ({ targetType, targetId }) =>
+    req(`/auth/me/hidden/${encodeURIComponent(targetType)}/${encodeURIComponent(targetId)}`, { method: 'DELETE' }),
+  clearHidden: () => req('/auth/me/hidden', { method: 'DELETE' }),
+
   // ----- settings (any authenticated account) -----
   // Nav overrides for the layouts the caller's own role renders, and the theme
   // catalog the appearance form is built from. A fifth group, not part of
@@ -656,6 +670,10 @@ export const api = {
     },
     handleContentReport: (id, body) =>
       req(`/admin/moderation/reports/${id}/handle`, { method: 'POST', body }),
+    // "Hide for everyone" (USER_SAFETY.md §4.1): hides the item through its own
+    // moderation and actions the report.
+    hideReportedItem: (id, body = {}) =>
+      req(`/admin/moderation/reports/${id}/hide`, { method: 'POST', body }),
     modRecent: (params = {}) => {
       const qs = new URLSearchParams()
       if (params.type) qs.set('type', params.type)