feat(safety): report, block and hide, MODULE_API 1.21.0

USER_SAFETY.md step 2 (core), with S11-S14 decided while building it.

- Reports: POST /player/reports takes any target type, core's forum
  types or a module's registered ones. One resolver
  (model/safety/targets.js) answers "what is this item, for this
  reader" and 404s an item the reader cannot see. Every report stores
  content_reports.snapshot; the queue shows a module item from it.
- Hide for everyone: POST /admin/moderation/reports/:id/hide hides the
  item through its own moderation (forum hide as staff, or the module's
  hide) and actions the report with actioned_with = 'hide'.
- Blocks (user_blocks) name an item, never a person, and land on the
  author's account first (S12); an unlinked game identity is blocked as
  itself and becomes an account block once linked (S14). Staff cannot
  be blocked; a block on someone later promoted stops applying (S8).
- Hide for me (user_hidden_items), /auth/me/blocks and /auth/me/hidden.
- Forum reads filter blocked authors and hidden items on the server and
  carry canBlock per thread and post.
- MODULE_API 1.21.0: api.registerReportTargets,
  api.registerGameIdentities, ctx.safety.forViewer and
  ctx.safety.staffAmong, so a module filters its own per-viewer feeds on
  the server (S11) and marks lines canBlock (S13).
- Web: Hide for me / Block author in the forum menus, a Blocked section
  on both account pages, Hide for everyone in the Reports queue.
- Tests, OpenAPI, route/guard/engagement manifests regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/src/model/reports/contentReports.db.js

@@ -15,7 +15,7 @@ const { query } = require('../../utils/db')
 const COLUMNS = `
   id, target_type, target_id, team_id, reporter_user_id, reporter_username,
   reason, detail, status, handled_by, handled_username, handled_note, handled_at,
-  created_at`
+  created_at, snapshot, actioned_with`
 
 const OPEN_STATUSES = ['open', 'reviewing']
 
@@ -28,13 +28,16 @@ const OPEN_STATUSES = ['open', 'reviewing']
  * comes back as a clean `null` so the caller can answer 409 without knowing what
  * a MySQL error code looks like.
  */
-async function insert({ targetType, targetId, teamId, reporterUserId, reporterUsername, reason, detail }) {
+async function insert({ targetType, targetId, teamId, reporterUserId, reporterUsername, reason, detail, snapshot }) {
   try {
     const res = await query(
       `INSERT INTO content_reports
-         (target_type, target_id, team_id, reporter_user_id, reporter_username, reason, detail)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
-      [targetType, targetId, teamId ?? null, reporterUserId, reporterUsername, reason, detail ?? null],
+         (target_type, target_id, team_id, reporter_user_id, reporter_username, reason, detail, snapshot)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        targetType, targetId, teamId ?? null, reporterUserId, reporterUsername, reason, detail ?? null,
+        snapshot ? JSON.stringify(snapshot) : null,
+      ],
     )
     return res.insertId
   } catch (err) {
@@ -93,13 +96,19 @@ async function openCount() {
  * `handled_*` is stamped for every status including `reviewing`, so "who has this"
  * is answerable while it is in progress and not only after it is closed — that is
  * what stops two staffers working the same report.
+ *
+ * `actionedWith` is written only when given (the queue's "Hide for everyone"):
+ * a later status change by hand records a new decision, and does not un-say
+ * that the item was hidden.
  */
-async function handle(id, { status, handledBy, handledUsername, note }) {
+async function handle(id, { status, handledBy, handledUsername, note, actionedWith }) {
+  const withAction = actionedWith !== undefined
   const res = await query(
     `UPDATE content_reports
         SET status = ?, handled_by = ?, handled_username = ?, handled_note = ?, handled_at = NOW()
+            ${withAction ? ', actioned_with = ?' : ''}
       WHERE id = ?`,
-    [status, handledBy, handledUsername, note ?? null, id],
+    [status, handledBy, handledUsername, note ?? null, ...(withAction ? [actionedWith] : []), id],
   )
   return res.affectedRows > 0
 }