fix(safety): team notifications skip members who block the author

#233 left this open: the forum hid a blocked author's posts from a
member, but the member was still pushed, put in the inbox and emailed
about them.

- teamNotify.forumPost excludes every member who blocks the post's
  author, or the member who started the thread (the forum 404s that
  thread for them). One recipient list, so push, the inbox and email
  skip the same people. userSafety.blockersOf answers it, and a staff
  author is blocked by nobody (S8). A failed lookup notifies without it.
- The daily digest applies each recipient's forumFilter at send time:
  blocked authors, blocked thread starters, hidden threads and posts.
  digestPostsSince now also returns the thread's created_by.
- A reply's notify payload carries threadAuthorUserId.

The Team activity feed needed nothing: forum posts are never written to
it (membership, renames and module game events only).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/src/model/safety/userSafety.model.js

@@ -280,6 +280,25 @@ async function forModuleViewer(moduleId, userId) {
   return out
 }
 
+/**
+ * The members whose blocks cover this author, for a notification about something
+ * the author wrote: a forum post is pushed, mailed and put in the inbox of every
+ * member of its Team, and a member who blocks the author must not be told about it
+ * (the forum itself already leaves the post out for them).
+ *
+ * S8 applies here too: a staff author is blocked by nobody, so this answers empty
+ * and the post reaches everyone. Answers account blocks only. A game block on the
+ * author's Steam id that S14 has not yet rewritten counts from the next time its
+ * owner reads the forum or their blocks, which is when the rewrite happens.
+ */
+async function blockersOf(authorUserId) {
+  const id = Number(authorUserId)
+  if (!Number.isInteger(id) || id <= 0) return []
+  const author = await db.userById(id)
+  if (!author || isStaffRole(author.role)) return []
+  return db.blockersOf(id)
+}
+
 /** `ctx.safety.staffAmong` (S13): which of these accounts are staff. */
 async function staffAmong(userIds) {
   const ids = [...new Set((Array.isArray(userIds) ? userIds : [])
@@ -301,6 +320,7 @@ module.exports = {
   clearHidden,
   forumFilter,
   forModuleViewer,
+  blockersOf,
   staffAmong,
   publicBlock,
 }