admin: add account spam restriction (join/message gate)

Adds a narrower spam sanction alongside the existing account freeze: a
restricted account keeps every existing membership and conversation, but
cannot join new channels/groups (public join or invite link) and cannot
start a new conversation with a non-contact. Reachable both as a standalone
admin action and as a decision on a reported user's moderation case, with
the same idempotent-supersession and appeal wiring freeze already has.

internal/domain/user.go

@@ -189,6 +189,14 @@ func AccountFrozenRestrictionReasons() []UserRestrictionReason {
 	}}
 }
 
+func AccountRestrictedRestrictionReasons() []UserRestrictionReason {
+	return []UserRestrictionReason{{
+		Platform: "all",
+		Reason:   "spam-restricted",
+		Text:     "This account has been restricted for suspected spam.",
+	}}
+}
+
 // PremiumActiveAt 报告用户在 now（Unix 秒）时刻是否为有效会员。
 // bot 永不为会员（官方语义；授予路径同样排除 bot，这里是双保险）。
 func (u User) PremiumActiveAt(now int64) bool {