Extends the reserved-usernames doc with a vulgar/offensive section, adds
CSV exports (username,reason) for both the categorized reserved-usernames
list and a filtered snapshot of fragment.com's sold usernames, and adds a
scripts/reserve_usernames.py CLI to bulk-feed a CSV into the admin panel's
reserved-usernames blocklist via the real login -> CSRF -> reserve-username
API flow.
Lower the username floor to 3 characters on the admin-only write path
(account/channel set-username), separate from the 5-character self-service
minimum, since a deliberately short operator handle isn't the squatting the
higher floor guards against. Channel admin username assignment previously
had no length/format validation at all; this adds it.
Also adds three reference docs: the client's deep-link (tg://, owpg://)
surface, an OpenAPI 3.1 spec for both admin HTTP APIs (built from source,
not the stale docs/admin-panel-api.en.md), and a starter reserved-username
blocklist.
