admin: add account spam restriction (join/message gate)

Adds a narrower spam sanction alongside the existing account freeze: a
restricted account keeps every existing membership and conversation, but
cannot join new channels/groups (public join or invite link) and cannot
start a new conversation with a non-contact. Reachable both as a standalone
admin action and as a decision on a reported user's moderation case, with
the same idempotent-supersession and appeal wiring freeze already has.

internal/store/postgres/moderation_cases.go

@@ -969,6 +969,10 @@ LIMIT 1`, string(current.Target.Type), current.Target.ID,
 			if domain.ModerationActionKind(kind) != domain.ModerationActionFreezeAccount {
 				return domain.ErrModerationActionConflict
 			}
+		case domain.ModerationActionUnrestrictAccount:
+			if domain.ModerationActionKind(kind) != domain.ModerationActionRestrictAccount {
+				return domain.ErrModerationActionConflict
+			}
 		default:
 			return domain.ErrModerationActionConflict
 		}
@@ -989,6 +993,11 @@ func moderationSanctionKinds(family domain.ModerationSanctionFamily) []string {
 			string(domain.ModerationActionFreezeAccount),
 			string(domain.ModerationActionUnfreezeAccount),
 		}
+	case domain.ModerationSanctionAccountRestrict:
+		return []string{
+			string(domain.ModerationActionRestrictAccount),
+			string(domain.ModerationActionUnrestrictAccount),
+		}
 	default:
 		return nil
 	}
@@ -1002,6 +1011,8 @@ func validateModerationActionsForTarget(target domain.Peer, actions []domain.Mod
 			// Both users and channels support protocol scam/fake flags.
 		case domain.ModerationActionFreezeAccount,
 			domain.ModerationActionUnfreezeAccount,
+			domain.ModerationActionRestrictAccount,
+			domain.ModerationActionUnrestrictAccount,
 			domain.ModerationActionDeletePrivateMessage,
 			domain.ModerationActionDeleteAccount:
 			if target.Type != domain.PeerTypeUser {