Adds a narrower spam sanction alongside the existing account freeze: a
restricted account keeps every existing membership and conversation, but
cannot join new channels/groups (public join or invite link) and cannot
start a new conversation with a non-contact. Reachable both as a standalone
admin action and as a decision on a reported user's moderation case, with
the same idempotent-supersession and appeal wiring freeze already has.
Sync telesrv b96f2dd (feat(bot): complete keyboards callbacks and durable delivery).
Skipped private docs and preserved public README files per sync rules; normalized the appearance seed log label for public naming.
