admin: add account spam restriction (join/message gate)

Adds a narrower spam sanction alongside the existing account freeze: a
restricted account keeps every existing membership and conversation, but
cannot join new channels/groups (public join or invite link) and cannot
start a new conversation with a non-contact. Reachable both as a standalone
admin action and as a decision on a reported user's moderation case, with
the same idempotent-supersession and appeal wiring freeze already has.

internal/domain/admin.go

@@ -53,3 +53,21 @@ type AccountFreezeNotification struct {
 	Frozen       bool
 	Attempts     int
 }
+
+// AccountRestriction is the durable, narrower spam sanction: unlike
+// AccountFreeze it does not make the account read-only. A restricted account
+// keeps every existing membership and conversation; it can only not join new
+// channels/groups and not start new conversations with non-contacts. Until,
+// when set, is when the restriction auto-lifts; a zero Until means it stays
+// in effect until an admin clears it.
+type AccountRestriction struct {
+	UserID     int64
+	Restricted bool
+	Version    int64
+	Since      time.Time
+	Until      time.Time
+	Reason     string
+	Actor      string
+	CommandID  string
+	UpdatedAt  time.Time
+}