usernames: operator reserved-username blocklist

A plain blocklist for names like @support - separate from the collectible
system, so a reservation has no owner, no price and no "bought on Fragment"
badge.

- reserved_usernames table + migration.
- Enforced in replacePeerUsernameTx (the single editable-username write point:
  account.updateUsername, channels.updateUsername, @BotFather /setusername) and
  in the collectible mint path; a reserved name returns USERNAME_OCCUPIED.
- admin.Service: ReserveUsername / UnreserveUsername (journalled commands) and
  the ReservedUsernames listing.
- adminapi: /v1/reserved-usernames{,/reserve,/unreserve}.
- telesrv-admin panel + a "Reserved Usernames" page in the web UI (dist rebuilt).
- Postgres and in-memory store implementations; the memory registry gains an
  optional reserved-name check so tests exercise the same rule.

internal/domain/reserved_username.go

@@ -0,0 +1,24 @@
+package domain
+
+import "time"
+
+// MaxReservedUsernameReasonLength bounds the operator note on a reservation.
+const MaxReservedUsernameReasonLength = 512
+
+// ReservedUsername is one entry in the operator username blocklist. A reserved
+// name cannot be taken as an editable username by any peer and cannot be minted
+// as a collectible.
+type ReservedUsername struct {
+	Username  string // display form (original case at reservation time)
+	Reason    string
+	Actor     string
+	CreatedAt time.Time
+}
+
+// ReservedUsernameFilter pages the blocklist. Query matches a username prefix
+// (case-insensitive); an empty query lists everything.
+type ReservedUsernameFilter struct {
+	Query  string
+	Limit  int
+	Offset int
+}