fix(admin): close PR review blockers

Keep bot credentials out of durable command results, fail bot deletion closed when session revocation fails, reject invalid scam/fake states at every write boundary, and make direct collectible grants a single replayable PostgreSQL aggregate.

Also lock admin gift sender/message limits and add regression coverage for rollback, replay, moderation constraints, and credential redaction.

internal/domain/star_gift.go

@@ -339,7 +339,7 @@ type StarGiftUpgradeRequest struct {
 }
 
 // AdminStarGiftGrant is one admin "give gift" command: deliver GiftID to
-// Recipient from Sender (0 => official system account 777000) at no charge.
+// Recipient from the official system account 777000 at no charge.
 // When Upgrade is set the gift is minted as a collectible; the optional
 // attribute IDs pin specific model/pattern/backdrop (0 => random). The
 // collectible number is always assigned automatically.
@@ -350,11 +350,24 @@ type AdminStarGiftGrant struct {
 	HideName            bool
 	Message             string
 	Upgrade             bool
+	CommandKey          string
+	Date                int
+	RecipientBlocked    bool
 	ModelAttributeID    int64
 	PatternAttributeID  int64
 	BackdropAttributeID int64
 }
 
+// AdminStarGiftGrantResult is the committed direct collectible assignment.
+// The saved gift, unique issuance, private message and replay receipt are one
+// aggregate transaction.
+type AdminStarGiftGrantResult struct {
+	Saved     SavedStarGift
+	Unique    UniqueStarGift
+	Send      SendPrivateTextResult
+	Duplicate bool
+}
+
 type StarGiftPurchaseRequest struct {
 	BuyerUserID      int64
 	BuyerPremium     bool