R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Infrastructure/MastodonController.cs

@@ -53,7 +53,15 @@ namespace PrivaPub.Api.Mastodon.Infrastructure
 					context.Result = Error(StatusCodes.Status403Forbidden, "This action is outside the authorized scopes");
 					return;
 				}
-				Me = await Resolve(User.GetClaim(Claims.Subject), HttpContext.RequestAborted);
+				var subject = User.GetClaim(Claims.Subject);
+				Me = await Resolve(subject, HttpContext.RequestAborted);
+				// a persona's token whose persona can no longer act (suspended, its login banned or deleted) is refused
+				// everywhere, as Mastodon refuses a revoked token; an application's own token has no persona
+				if (Me == default && !string.IsNullOrEmpty(subject) && !subject.StartsWith("app:", StringComparison.Ordinal))
+				{
+					context.Result = Error(StatusCodes.Status401Unauthorized, "The access token is invalid");
+					return;
+				}
 			}
 			if (scope?.RequiresUser == true && Me == default)
 			{
@@ -75,7 +83,10 @@ namespace PrivaPub.Api.Mastodon.Infrastructure
 			var root = await db.RootUsers.MatchID(link.RootId).ExecuteFirstAsync(token);
 			if (root is not { IsBanned: false, DeletedAt: null })
 				return default;
-			return await services.GetRequiredService<ILocalActorService>().FindById(LocalActorKind.Person, avatarId, token);
+			var avatar = await db.Avatars.MatchID(avatarId).ExecuteFirstAsync(token);
+			if (avatar is not { DeletionAt: null, SuspendedAt: null })
+				return default;
+			return services.GetRequiredService<ILocalActorService>().FromAvatar(avatar) is { Suspended: false } me ? me : default;
 		}
 
 		protected JsonResult Json(object value, int status = StatusCodes.Status200OK) =>