R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Controllers/StreamingController.cs

@@ -159,6 +159,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 						continue;
 					await Send(new JsonObject { ["stream"] = new JsonArray(key.Wire.Select(w => (JsonNode)w).ToArray()), ["event"] = e.Name, ["payload"] = payload });
 				}
+				// the queue ends only when the stream was closed from here (the persona was suspended): the socket goes too
+				done.Cancel();
 				await reading;
 			}
 			catch (Exception ex) when (ex is OperationCanceledException or WebSocketException)
@@ -202,20 +204,23 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			try
 			{
 				await Write(":)\n\n");
+				using var done = CancellationTokenSource.CreateLinkedTokenSource(token);
 				var beating = Task.Run(async () =>
 				{
-					while (!token.IsCancellationRequested)
+					while (!done.IsCancellationRequested)
 					{
-						await Task.Delay(KeepAlive, token);
+						await Task.Delay(KeepAlive, done.Token);
 						await Write(":thump\n\n");
 					}
-				}, token);
+				}, done.Token);
 				await foreach (var (_, e) in listener.Queue.Reader.ReadAllAsync(token))
 				{
 					if (await Payload(e, token) is not { } payload)
 						continue;
 					await Write($"event: {e.Name}\ndata: {payload}\n\n");
 				}
+				// closed from here (the persona was suspended): the response ends
+				done.Cancel();
 				await beating;
 			}
 			catch (OperationCanceledException)