feat(safety): report, block and hide, MODULE_API 1.21.0

USER_SAFETY.md step 2 (core), with S11-S14 decided while building it.

- Reports: POST /player/reports takes any target type, core's forum
  types or a module's registered ones. One resolver
  (model/safety/targets.js) answers "what is this item, for this
  reader" and 404s an item the reader cannot see. Every report stores
  content_reports.snapshot; the queue shows a module item from it.
- Hide for everyone: POST /admin/moderation/reports/:id/hide hides the
  item through its own moderation (forum hide as staff, or the module's
  hide) and actions the report with actioned_with = 'hide'.
- Blocks (user_blocks) name an item, never a person, and land on the
  author's account first (S12); an unlinked game identity is blocked as
  itself and becomes an account block once linked (S14). Staff cannot
  be blocked; a block on someone later promoted stops applying (S8).
- Hide for me (user_hidden_items), /auth/me/blocks and /auth/me/hidden.
- Forum reads filter blocked authors and hidden items on the server and
  carry canBlock per thread and post.
- MODULE_API 1.21.0: api.registerReportTargets,
  api.registerGameIdentities, ctx.safety.forViewer and
  ctx.safety.staffAmong, so a module filters its own per-viewer feeds on
  the server (S11) and marks lines canBlock (S13).
- Web: Hide for me / Block author in the forum menus, a Blocked section
  on both account pages, Hide for everyone in the Reports queue.
- Tests, OpenAPI, route/guard/engagement manifests regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/swagger/swagger.js

@@ -69,6 +69,7 @@ const doc = {
     { name: 'Auth · SSO', description: 'OAuth2 / OIDC provider discovery and redirect flow' },
     { name: 'Public', description: 'Unauthenticated site content (settings, posts, wiki, contact)' },
     { name: 'Player · Appeals', description: 'Player-submitted moderation appeals' },
+    { name: 'Player · Reports', description: 'Reporting a forum or game item to site staff' },
     { name: 'Settings', description: 'Site-wide settings any authenticated account may read (nav overrides)' },
     { name: 'Admin · Dashboard', description: 'Dashboard summary and site mode' },
     { name: 'Admin · Posts', description: 'News / five-on-friday / newsletter / screenshots + uploads' },
@@ -514,6 +515,55 @@ const doc = {
           message: { type: 'string', example: 'Your password is incorrect.' },
         },
       },
+      // Report, block and hide (USER_SAFETY.md §4.1, MODULE_API 1.21.0).
+      SafetyTarget: {
+        type: 'object',
+        required: ['targetType', 'targetId'],
+        description: 'One item: a forum thread or post, or a game module’s item. `team_forum_upload` can be reported but not hidden or blocked from — hiding the post it is in, or blocking its author, is what hides it.',
+        properties: {
+          targetType: { type: 'string', example: 'rust.chat', description: '`team_forum_thread`, `team_forum_post`, or a module’s registered type such as `rust.chat`.' },
+          targetId: { type: 'integer', example: 4410 },
+        },
+      },
+      ReportRequest: {
+        type: 'object',
+        required: ['targetType', 'targetId', 'reason'],
+        properties: {
+          targetType: { type: 'string', example: 'rust.chat', description: '`team_forum_thread`, `team_forum_post`, `team_forum_upload`, or a module’s registered type such as `rust.chat`.' },
+          targetId: { type: 'integer', example: 4410 },
+          reason: { type: 'string', enum: ['spam', 'abuse', 'sexual', 'illegal', 'impersonation', 'other'] },
+          detail: { type: 'string', maxLength: 500 },
+        },
+      },
+      UserBlock: {
+        type: 'object',
+        description: 'One of the signed-in member’s blocks. `account` blocks name a website account; `game` blocks name an unlinked game identity (a Steam id) and become account blocks once it is linked (S14). A block on a staff account does not apply (S8) and says so with `reason: "staff"`.',
+        properties: {
+          id: { type: 'integer' },
+          kind: { type: 'string', enum: ['account', 'game'] },
+          name: { type: 'string', example: 'rusty' },
+          identity: {
+            type: 'object',
+            nullable: true,
+            properties: {
+              module: { type: 'string', example: 'rust' },
+              kind: { type: 'string', example: 'steam' },
+              label: { type: 'string', example: 'Steam account' },
+              id: { type: 'string', example: '76561198000000123' },
+            },
+          },
+          applies: { type: 'boolean' },
+          reason: { type: 'string', nullable: true, enum: ['staff', null] },
+          createdAt: { type: 'string', format: 'date-time' },
+        },
+      },
+      SafetyRefusal: {
+        type: 'object',
+        properties: {
+          code: { type: 'string', enum: ['unknown_target', 'not_found', 'self', 'staff', 'no_author', 'already_blocked', 'module_unavailable'] },
+          message: { type: 'string', example: 'You can’t block a staff member.' },
+        },
+      },
       ChangePasswordRequest: {
         type: 'object',
         required: ['newPassword'],
@@ -862,7 +912,7 @@ const doc = {
           + 'because a Team\'s leaders are exactly the people who will not report their own Team.',
         properties: {
           id: { type: 'integer', example: 41 },
-          targetType: { type: 'string', example: 'team_forum_post', description: 'team_forum_thread | team_forum_post | team_forum_upload' },
+          targetType: { type: 'string', example: 'team_forum_post', description: 'team_forum_thread | team_forum_post | team_forum_upload, or a game module\'s registered type such as `rust.chat` (MODULE_API 1.21.0).' },
           targetId: { type: 'integer', example: 812 },
           teamId: { type: 'integer', nullable: true, example: 7, description: 'Denormalised so the queue can filter by Team.' },
           reporter: { type: 'string', example: 'wanderer', description: 'Username snapshot. Staff see it even after the account is deleted, with `reporterDeleted` true; anyone else would see "[deleted player]" (ACCOUNT_DELETION.md AD5, AD6).' },
@@ -874,6 +924,23 @@ const doc = {
           handledByDeleted: { type: 'boolean', example: false },
           handledNote: { type: 'string', nullable: true, example: 'Post hidden, author warned.' },
           handledAt: { type: 'string', format: 'date-time', nullable: true },
+          actionedWith: { type: 'string', nullable: true, enum: ['hide', null], description: 'What the queue DID when it actioned the report: `hide` is "Hide for everyone" (USER_SAFETY.md §4.1). NULL when "actioned" only records a decision.' },
+          snapshot: {
+            type: 'object',
+            nullable: true,
+            description: 'What the item said when it was reported, kept on the report so it outlives the item and an author\'s later edit (USER_SAFETY.md §4.1). NULL on reports filed before MODULE_API 1.21.0. The author\'s name follows the same rule as `reporter`; `authorIdentity` is the game identity of an author with no account (an unlinked Rust chat speaker\'s Steam id).',
+            properties: {
+              label: { type: 'string', example: 'Chat line' },
+              title: { type: 'string', nullable: true },
+              text: { type: 'string', nullable: true, example: 'gg ez' },
+              at: { type: 'string', nullable: true },
+              where: { type: 'object', additionalProperties: true },
+              module: { type: 'string', nullable: true, example: 'rust' },
+              author: { type: 'string', nullable: true, example: 'Rusty' },
+              authorDeleted: { type: 'boolean' },
+              authorIdentity: { type: 'object', nullable: true, properties: { kind: { type: 'string', example: 'steam' }, id: { type: 'string', example: '76561198000000123' } } },
+            },
+          },
           createdAt: { type: 'string', format: 'date-time' },
           target: {
             type: 'object',
@@ -883,7 +950,12 @@ const doc = {
               + '"somebody reported this and by the time we looked it was gone" is a fact a moderator needs. '
               + 'An upload target carries uploader, byte size and the SNIFFED mimetype (§5.6 rule 4).',
             properties: {
-              kind: { type: 'string', enum: ['thread', 'post', 'upload'], example: 'post' },
+              kind: { type: 'string', enum: ['thread', 'post', 'upload', 'module'], example: 'post', description: '`module` is a game module\'s item, read from the stored snapshot: core cannot read the module\'s rows.' },
+              module: { type: 'string', nullable: true, example: 'rust' },
+              label: { type: 'string', nullable: true, example: 'Chat line' },
+              text: { type: 'string', nullable: true },
+              at: { type: 'string', nullable: true },
+              where: { type: 'object', nullable: true, additionalProperties: true },
               threadId: { type: 'integer', nullable: true, example: 19 },
               threadTitle: { type: 'string', nullable: true, example: 'Raid night' },
               postId: { type: 'integer', nullable: true, example: 812 },