usernames: operator reserved-username blocklist

A plain blocklist for names like @support - separate from the collectible
system, so a reservation has no owner, no price and no "bought on Fragment"
badge.

- reserved_usernames table + migration.
- Enforced in replacePeerUsernameTx (the single editable-username write point:
  account.updateUsername, channels.updateUsername, @BotFather /setusername) and
  in the collectible mint path; a reserved name returns USERNAME_OCCUPIED.
- admin.Service: ReserveUsername / UnreserveUsername (journalled commands) and
  the ReservedUsernames listing.
- adminapi: /v1/reserved-usernames{,/reserve,/unreserve}.
- telesrv-admin panel + a "Reserved Usernames" page in the web UI (dist rebuilt).
- Postgres and in-memory store implementations; the memory registry gains an
  optional reserved-name check so tests exercise the same rule.

internal/adminapi/server.go

@@ -98,6 +98,9 @@ type Service interface {
 	CollectibleUsernames(ctx context.Context, filter domain.CollectibleUsernameFilter) ([]domain.CollectibleUsername, error)
 	CollectibleUsernameByID(ctx context.Context, id int64) (domain.CollectibleUsername, error)
 	CollectibleUsernameTransfers(ctx context.Context, collectibleID int64, limit int) ([]domain.CollectibleUsernameTransfer, error)
+	ReserveUsername(ctx context.Context, req admin.ReserveUsernameRequest) (admin.CommandResult, error)
+	UnreserveUsername(ctx context.Context, req admin.UnreserveUsernameRequest) (admin.CommandResult, error)
+	ReservedUsernames(ctx context.Context, filter domain.ReservedUsernameFilter) ([]domain.ReservedUsername, error)
 	ClaimVerification(ctx context.Context, req admin.ClaimVerificationRequest) (admin.CommandResult, error)
 	ApproveVerification(ctx context.Context, req admin.ApproveVerificationRequest) (admin.CommandResult, error)
 	RejectVerification(ctx context.Context, req admin.RejectVerificationRequest) (admin.CommandResult, error)
@@ -234,6 +237,9 @@ func (s *Server) routes() http.Handler {
 	mux.HandleFunc("POST /v1/collectible-usernames/delete", s.authenticated(s.handleDeleteCollectibleUsername))
 	mux.HandleFunc("GET /v1/collectible-usernames", s.authenticated(s.handleCollectibleUsernames))
 	mux.HandleFunc("GET /v1/collectible-usernames/{id}", s.authenticated(s.handleCollectibleUsername))
+	mux.HandleFunc("POST /v1/reserved-usernames/reserve", s.authenticated(s.handleReserveUsername))
+	mux.HandleFunc("POST /v1/reserved-usernames/unreserve", s.authenticated(s.handleUnreserveUsername))
+	mux.HandleFunc("GET /v1/reserved-usernames", s.authenticated(s.handleReservedUsernames))
 	// Official platform verification. Unlike every route above, these carry a
 	// named permission, so a scoped token can be given the review surface and
 	// nothing else. Revocation additionally requires verification.revoke.
@@ -1186,6 +1192,54 @@ func (s *Server) handleDeleteCollectibleUsername(w http.ResponseWriter, r *http.
 	writeCommandResult(w, result, err)
 }
 
+func (s *Server) handleReserveUsername(w http.ResponseWriter, r *http.Request) {
+	var req admin.ReserveUsernameRequest
+	if !decodeJSON(w, r, &req) {
+		return
+	}
+	result, err := s.svc.ReserveUsername(r.Context(), req)
+	writeCommandResult(w, result, err)
+}
+
+func (s *Server) handleUnreserveUsername(w http.ResponseWriter, r *http.Request) {
+	var req admin.UnreserveUsernameRequest
+	if !decodeJSON(w, r, &req) {
+		return
+	}
+	result, err := s.svc.UnreserveUsername(r.Context(), req)
+	writeCommandResult(w, result, err)
+}
+
+func (s *Server) handleReservedUsernames(w http.ResponseWriter, r *http.Request) {
+	query := r.URL.Query()
+	filter := domain.ReservedUsernameFilter{Query: query.Get("q")}
+	limit, ok := optionalQueryInt(w, query, "limit")
+	if !ok {
+		return
+	}
+	filter.Limit = limit
+	offset, ok := optionalQueryInt(w, query, "offset")
+	if !ok {
+		return
+	}
+	filter.Offset = offset
+	items, err := s.svc.ReservedUsernames(r.Context(), filter)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "list failed")
+		return
+	}
+	out := make([]map[string]any, 0, len(items))
+	for _, item := range items {
+		out = append(out, map[string]any{
+			"username":   item.Username,
+			"reason":     item.Reason,
+			"actor":      item.Actor,
+			"created_at": item.CreatedAt.Unix(),
+		})
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"reserved": out})
+}
+
 func (s *Server) handleCollectibleUsernames(w http.ResponseWriter, r *http.Request) {
 	query := r.URL.Query()
 	filter := domain.CollectibleUsernameFilter{

internal/adminapi/server_test.go

@@ -510,12 +510,30 @@ func (fakeService) ReviewModerationAppeal(context.Context, domain.ModerationDeci
 
 type captureCollectibleUsernameService struct {
 	fakeService
-	mint     admin.MintCollectibleUsernameRequest
-	transfer admin.TransferCollectibleUsernameRequest
-	revoke   admin.RevokeCollectibleUsernameRequest
-	del      admin.DeleteCollectibleUsernameRequest
-	filter   domain.CollectibleUsernameFilter
-	assetID  int64
+	mint      admin.MintCollectibleUsernameRequest
+	transfer  admin.TransferCollectibleUsernameRequest
+	revoke    admin.RevokeCollectibleUsernameRequest
+	del       admin.DeleteCollectibleUsernameRequest
+	reserve   admin.ReserveUsernameRequest
+	unreserve admin.UnreserveUsernameRequest
+	resFilter domain.ReservedUsernameFilter
+	filter    domain.CollectibleUsernameFilter
+	assetID   int64
+}
+
+func (s *captureCollectibleUsernameService) ReserveUsername(_ context.Context, req admin.ReserveUsernameRequest) (admin.CommandResult, error) {
+	s.reserve = req
+	return admin.CommandResult{CommandID: req.CommandID, Status: "completed", DryRun: req.DryRun}, nil
+}
+
+func (s *captureCollectibleUsernameService) UnreserveUsername(_ context.Context, req admin.UnreserveUsernameRequest) (admin.CommandResult, error) {
+	s.unreserve = req
+	return admin.CommandResult{CommandID: req.CommandID, Status: "completed", DryRun: req.DryRun}, nil
+}
+
+func (s *captureCollectibleUsernameService) ReservedUsernames(_ context.Context, filter domain.ReservedUsernameFilter) ([]domain.ReservedUsername, error) {
+	s.resFilter = filter
+	return []domain.ReservedUsername{{Username: "support", Reason: "official", Actor: "ops"}}, nil
 }
 
 func (s *captureCollectibleUsernameService) MintCollectibleUsername(_ context.Context, req admin.MintCollectibleUsernameRequest) (admin.CommandResult, error) {
@@ -731,3 +749,49 @@ func (fakeService) CollectibleUsernameByID(context.Context, int64) (domain.Colle
 func (fakeService) CollectibleUsernameTransfers(context.Context, int64, int) ([]domain.CollectibleUsernameTransfer, error) {
 	return nil, nil
 }
+
+func (fakeService) ReserveUsername(_ context.Context, req admin.ReserveUsernameRequest) (admin.CommandResult, error) {
+	return admin.CommandResult{CommandID: req.CommandID, Status: "completed", DryRun: req.DryRun}, nil
+}
+
+func (fakeService) UnreserveUsername(_ context.Context, req admin.UnreserveUsernameRequest) (admin.CommandResult, error) {
+	return admin.CommandResult{CommandID: req.CommandID, Status: "completed", DryRun: req.DryRun}, nil
+}
+
+func (fakeService) ReservedUsernames(context.Context, domain.ReservedUsernameFilter) ([]domain.ReservedUsername, error) {
+	return nil, nil
+}
+
+func TestAdminAPIReservedUsernames(t *testing.T) {
+	svc := &captureCollectibleUsernameService{}
+	srv := &Server{token: "secret", svc: svc}
+
+	reserve := httptest.NewRequest(http.MethodPost, "/v1/reserved-usernames/reserve", strings.NewReader(
+		`{"command_id":"r-1","actor":"ops","reason":"official","username":"support"}`))
+	reserve.Header.Set("Authorization", "Bearer secret")
+	rec := httptest.NewRecorder()
+	srv.routes().ServeHTTP(rec, reserve)
+	if rec.Code != http.StatusOK || svc.reserve.Username != "support" || svc.reserve.CommandID != "r-1" {
+		t.Fatalf("reserve status=%d req=%+v", rec.Code, svc.reserve)
+	}
+
+	unreserve := httptest.NewRequest(http.MethodPost, "/v1/reserved-usernames/unreserve", strings.NewReader(
+		`{"command_id":"u-1","actor":"ops","reason":"done","username":"support"}`))
+	unreserve.Header.Set("Authorization", "Bearer secret")
+	rec = httptest.NewRecorder()
+	srv.routes().ServeHTTP(rec, unreserve)
+	if rec.Code != http.StatusOK || svc.unreserve.Username != "support" {
+		t.Fatalf("unreserve status=%d req=%+v", rec.Code, svc.unreserve)
+	}
+
+	list := httptest.NewRequest(http.MethodGet, "/v1/reserved-usernames?q=sup&limit=10", nil)
+	list.Header.Set("Authorization", "Bearer secret")
+	rec = httptest.NewRecorder()
+	srv.routes().ServeHTTP(rec, list)
+	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), `"username":"support"`) {
+		t.Fatalf("list status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	if svc.resFilter.Query != "sup" || svc.resFilter.Limit != 10 {
+		t.Fatalf("list filter = %+v", svc.resFilter)
+	}
+}