fix(admin): close PR review blockers

Keep bot credentials out of durable command results, fail bot deletion closed when session revocation fails, reject invalid scam/fake states at every write boundary, and make direct collectible grants a single replayable PostgreSQL aggregate.

Also lock admin gift sender/message limits and add regression coverage for rollback, replay, moderation constraints, and credential redaction.

internal/domain/user_errors.go

@@ -12,6 +12,9 @@ var (
 	ErrUserNotFound              = errors.New("user not found")
 	ErrUserFrozen                = errors.New("user account frozen")
 	ErrAuthenticatedScopeInvalid = errors.New("authenticated user scope invalid")
+	// ErrPeerModerationFlagsInvalid rejects the impossible scam+fake state at
+	// every write boundary shared by user, bot and channel projections.
+	ErrPeerModerationFlagsInvalid = errors.New("peer moderation flags invalid")
 	// ErrPremiumRequired 表示该操作仅限有效会员（PREMIUM_ACCOUNT_REQUIRED）。
 	ErrPremiumRequired = errors.New("premium account required")
 	// ErrPremiumBotUnsupported 表示 bot 账号不可被授予会员（官方语义）。