usernames: operator reserved-username blocklist

A plain blocklist for names like @support - separate from the collectible
system, so a reservation has no owner, no price and no "bought on Fragment"
badge.

- reserved_usernames table + migration.
- Enforced in replacePeerUsernameTx (the single editable-username write point:
  account.updateUsername, channels.updateUsername, @BotFather /setusername) and
  in the collectible mint path; a reserved name returns USERNAME_OCCUPIED.
- admin.Service: ReserveUsername / UnreserveUsername (journalled commands) and
  the ReservedUsernames listing.
- adminapi: /v1/reserved-usernames{,/reserve,/unreserve}.
- telesrv-admin panel + a "Reserved Usernames" page in the web UI (dist rebuilt).
- Postgres and in-memory store implementations; the memory registry gains an
  optional reserved-name check so tests exercise the same rule.

internal/adminapi/server.go

@@ -100,6 +100,9 @@ type Service interface {
 	CollectibleUsernames(ctx context.Context, filter domain.CollectibleUsernameFilter) ([]domain.CollectibleUsername, error)
 	CollectibleUsernameByID(ctx context.Context, id int64) (domain.CollectibleUsername, error)
 	CollectibleUsernameTransfers(ctx context.Context, collectibleID int64, limit int) ([]domain.CollectibleUsernameTransfer, error)
+	ReserveUsername(ctx context.Context, req admin.ReserveUsernameRequest) (admin.CommandResult, error)
+	UnreserveUsername(ctx context.Context, req admin.UnreserveUsernameRequest) (admin.CommandResult, error)
+	ReservedUsernames(ctx context.Context, filter domain.ReservedUsernameFilter) ([]domain.ReservedUsername, error)
 	ClaimVerification(ctx context.Context, req admin.ClaimVerificationRequest) (admin.CommandResult, error)
 	ApproveVerification(ctx context.Context, req admin.ApproveVerificationRequest) (admin.CommandResult, error)
 	RejectVerification(ctx context.Context, req admin.RejectVerificationRequest) (admin.CommandResult, error)
@@ -238,6 +241,9 @@ func (s *Server) routes() http.Handler {
 	mux.HandleFunc("POST /v1/collectible-usernames/delete", s.authenticated(s.handleDeleteCollectibleUsername))
 	mux.HandleFunc("GET /v1/collectible-usernames", s.authenticated(s.handleCollectibleUsernames))
 	mux.HandleFunc("GET /v1/collectible-usernames/{id}", s.authenticated(s.handleCollectibleUsername))
+	mux.HandleFunc("POST /v1/reserved-usernames/reserve", s.authenticated(s.handleReserveUsername))
+	mux.HandleFunc("POST /v1/reserved-usernames/unreserve", s.authenticated(s.handleUnreserveUsername))
+	mux.HandleFunc("GET /v1/reserved-usernames", s.authenticated(s.handleReservedUsernames))
 	// Official platform verification. Unlike every route above, these carry a
 	// named permission, so a scoped token can be given the review surface and
 	// nothing else. Revocation additionally requires verification.revoke.
@@ -1208,6 +1214,54 @@ func (s *Server) handleDeleteCollectibleUsername(w http.ResponseWriter, r *http.
 	writeCommandResult(w, result, err)
 }
 
+func (s *Server) handleReserveUsername(w http.ResponseWriter, r *http.Request) {
+	var req admin.ReserveUsernameRequest
+	if !decodeJSON(w, r, &req) {
+		return
+	}
+	result, err := s.svc.ReserveUsername(r.Context(), req)
+	writeCommandResult(w, result, err)
+}
+
+func (s *Server) handleUnreserveUsername(w http.ResponseWriter, r *http.Request) {
+	var req admin.UnreserveUsernameRequest
+	if !decodeJSON(w, r, &req) {
+		return
+	}
+	result, err := s.svc.UnreserveUsername(r.Context(), req)
+	writeCommandResult(w, result, err)
+}
+
+func (s *Server) handleReservedUsernames(w http.ResponseWriter, r *http.Request) {
+	query := r.URL.Query()
+	filter := domain.ReservedUsernameFilter{Query: query.Get("q")}
+	limit, ok := optionalQueryInt(w, query, "limit")
+	if !ok {
+		return
+	}
+	filter.Limit = limit
+	offset, ok := optionalQueryInt(w, query, "offset")
+	if !ok {
+		return
+	}
+	filter.Offset = offset
+	items, err := s.svc.ReservedUsernames(r.Context(), filter)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "list failed")
+		return
+	}
+	out := make([]map[string]any, 0, len(items))
+	for _, item := range items {
+		out = append(out, map[string]any{
+			"username":   item.Username,
+			"reason":     item.Reason,
+			"actor":      item.Actor,
+			"created_at": item.CreatedAt.Unix(),
+		})
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"reserved": out})
+}
+
 func (s *Server) handleCollectibleUsernames(w http.ResponseWriter, r *http.Request) {
 	query := r.URL.Query()
 	filter := domain.CollectibleUsernameFilter{