feat(safety): report, block and hide, MODULE_API 1.21.0

USER_SAFETY.md step 2 (core), with S11-S14 decided while building it.

- Reports: POST /player/reports takes any target type, core's forum
  types or a module's registered ones. One resolver
  (model/safety/targets.js) answers "what is this item, for this
  reader" and 404s an item the reader cannot see. Every report stores
  content_reports.snapshot; the queue shows a module item from it.
- Hide for everyone: POST /admin/moderation/reports/:id/hide hides the
  item through its own moderation (forum hide as staff, or the module's
  hide) and actions the report with actioned_with = 'hide'.
- Blocks (user_blocks) name an item, never a person, and land on the
  author's account first (S12); an unlinked game identity is blocked as
  itself and becomes an account block once linked (S14). Staff cannot
  be blocked; a block on someone later promoted stops applying (S8).
- Hide for me (user_hidden_items), /auth/me/blocks and /auth/me/hidden.
- Forum reads filter blocked authors and hidden items on the server and
  carry canBlock per thread and post.
- MODULE_API 1.21.0: api.registerReportTargets,
  api.registerGameIdentities, ctx.safety.forViewer and
  ctx.safety.staffAmong, so a module filters its own per-viewer feeds on
  the server (S11) and marks lines canBlock (S13).
- Web: Hide for me / Block author in the forum menus, a Blocked section
  on both account pages, Hide for everyone in the Reports queue.
- Tests, OpenAPI, route/guard/engagement manifests regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/src/router/v1/admin/moderation.controller.js

@@ -358,6 +358,34 @@ async function handleContentReport(req, res) {
   }
 }
 
+/**
+ * Hide the reported item for everyone, and action the report (USER_SAFETY.md
+ * §4.1). The item goes through its own hide — the forum's moderation, or the
+ * module's — so this is a staff moderation of the content and is audited as one.
+ */
+async function hideReportedItem(req, res) {
+  try {
+    const result = await contentReports.hideForEveryone({
+      id: Number(req.params.id),
+      actor: req.user,
+      note: req.body.note,
+    })
+    if (!result.ok) return res.status(result.status || 400).json({ message: result.error })
+
+    const r = result.report
+    await activity.log({
+      req,
+      action: 'moderation.report.hide',
+      detail: `${req.user.username} (#${req.user.id}) hid ${r.targetType} #${r.targetId} for everyone `
+        + `from report #${req.params.id}${req.body.note ? `: "${req.body.note}"` : ''}`,
+    })
+    return res.json(r)
+  } catch (err) {
+    log.error('hideReportedItem failed', { error: err.message })
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
+}
+
 module.exports = {
   getSummary,
   getRecent,
@@ -376,4 +404,5 @@ module.exports = {
   getUserAppeals,
   getContentReports,
   handleContentReport,
+  hideReportedItem,
 }