admin: add account spam restriction (join/message gate)

Adds a narrower spam sanction alongside the existing account freeze: a
restricted account keeps every existing membership and conversation, but
cannot join new channels/groups (public join or invite link) and cannot
start a new conversation with a non-contact. Reachable both as a standalone
admin action and as a decision on a reported user's moderation case, with
the same idempotent-supersession and appeal wiring freeze already has.

internal/rpc/layer_dispatch.go

@@ -309,6 +309,9 @@ func (r *Router) DispatchAdmitted(
 	if err := r.checkFrozenRPC(ctx, method); err != nil {
 		return nil, method, err
 	}
+	if err := r.checkRestrictedRPC(ctx, method); err != nil {
+		return nil, method, err
+	}
 	if profileKnown && profileEvidenceFresh {
 		r.maybeMarkSessionReceivesUpdates(ctx)
 	}