fix(admin): close PR review blockers

Keep bot credentials out of durable command results, fail bot deletion closed when session revocation fails, reject invalid scam/fake states at every write boundary, and make direct collectible grants a single replayable PostgreSQL aggregate.

Also lock admin gift sender/message limits and add regression coverage for rollback, replay, moderation constraints, and credential redaction.

internal/domain/star_gift.go

@@ -339,7 +339,7 @@ type StarGiftUpgradeRequest struct {
 }
 
 // AdminStarGiftGrant is one admin "give gift" command: deliver GiftID to
-// Recipient from Sender (0 => official system account 777000) at no charge.
+// Recipient from the official system account 777000 at no charge.
 // When Upgrade is set the gift is minted as a collectible; the optional
 // attribute IDs pin specific model/pattern/backdrop (0 => random). The
 // collectible number is always assigned automatically.
@@ -350,11 +350,24 @@ type AdminStarGiftGrant struct {
 	HideName            bool
 	Message             string
 	Upgrade             bool
+	CommandKey          string
+	Date                int
+	RecipientBlocked    bool
 	ModelAttributeID    int64
 	PatternAttributeID  int64
 	BackdropAttributeID int64
 }
 
+// AdminStarGiftGrantResult is the committed direct collectible assignment.
+// The saved gift, unique issuance, private message and replay receipt are one
+// aggregate transaction.
+type AdminStarGiftGrantResult struct {
+	Saved     SavedStarGift
+	Unique    UniqueStarGift
+	Send      SendPrivateTextResult
+	Duplicate bool
+}
+
 type StarGiftPurchaseRequest struct {
 	BuyerUserID      int64
 	BuyerPremium     bool

internal/domain/user_errors.go

@@ -12,6 +12,9 @@ var (
 	ErrUserNotFound              = errors.New("user not found")
 	ErrUserFrozen                = errors.New("user account frozen")
 	ErrAuthenticatedScopeInvalid = errors.New("authenticated user scope invalid")
+	// ErrPeerModerationFlagsInvalid rejects the impossible scam+fake state at
+	// every write boundary shared by user, bot and channel projections.
+	ErrPeerModerationFlagsInvalid = errors.New("peer moderation flags invalid")
 	// ErrPremiumRequired 表示该操作仅限有效会员（PREMIUM_ACCOUNT_REQUIRED）。
 	ErrPremiumRequired = errors.New("premium account required")
 	// ErrPremiumBotUnsupported 表示 bot 账号不可被授予会员（官方语义）。