R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Infrastructure/Cli/AdminCommands.cs

@@ -19,6 +19,7 @@ namespace PrivaPub.Infrastructure.Cli
 	{
 		const string Usage = """
 			usage: PrivaPub admin promote|demote <root>
+			       PrivaPub admin role <root> <user|moderator|admin>   a login's role; promote and demote are role admin and user
 			       PrivaPub admin create-root <login> [--admin]   the password is read from standard input
 			       PrivaPub admin move-persona <persona> <root>   gives a persona to another login; its Mastodon tokens end
 			       PrivaPub admin delete-root <root>              deletes a login and every persona it still has
@@ -47,7 +48,9 @@ namespace PrivaPub.Infrastructure.Cli
 			switch (args)
 			{
 				case [("promote" or "demote") and var verb, var userName]:
-					return await Promote(services, verb == "promote", userName, output);
+					return await Role(services, userName, verb == "promote" ? RootRole.Admin : RootRole.User, output);
+				case ["role", var userName, var role] when RootUser.TryParseRole(role, out var parsed):
+					return await Role(services, userName, parsed, output);
 				case ["create-root", var login, .. var flags] when flags.All(f => f == "--admin"):
 					return await CreateRoot(services, login, input.ReadLine(), flags.Contains("--admin"), output);
 				case ["move-persona", var persona, var root]:
@@ -194,27 +197,37 @@ namespace PrivaPub.Infrastructure.Cli
 		static Task Log(IServiceProvider services, string action, string kind, string id, string label, string note = default) =>
 			services.GetRequiredService<IModerationLog>().Write(AdminAction.Cli, action, kind, id, label, note: note);
 
-		static async Task<int> Promote(IServiceProvider services, bool promote, string userName, TextWriter output, bool created = false)
+		// The command line is the way back, so it may leave the server without an administrator (the client's route refuses
+		// to); it says so, and `role <root> admin` gives one back.
+		static async Task<int> Role(IServiceProvider services, string userName, RootRole role, TextWriter output, bool created = false)
 		{
 			userName = userName.ToLowerInvariant();
-			var user = await DB.Default.Find<RootUser>().Match(u => u.UserName == userName).ExecuteFirstAsync();
+			var user = await DB.Default.Find<RootUser>().Match(u => u.UserName == userName && u.DeletedAt == null).ExecuteFirstAsync();
 			if (user == default)
 			{
 				Console.Error.WriteLine($"no root user '{userName}'");
 				return 1;
 			}
 
-			user.SetAdmin(promote);
-			await DB.Default.SaveAsync(user);
-			if (promote)
+			var was = user.Role;
+			user.SetRole(role);
+			await DB.Default.Update<RootUser>().MatchID(user.ID).Modify(u => u.Policies, user.Policies).Modify(u => u.UpdatedAt, user.UpdatedAt).ExecuteAsync();
+			if (role == RootRole.Admin)
 				await ServerSetup.Seal(user.ID, default);//an administrator exists: the client's setup is closed
-			if (!created)
-				await Log(services, promote ? AdminActions.RootPromote : AdminActions.RootDemote, AdminTargets.Root, user.ID, userName);
+			if (!created && was != role)
+				await Log(services, role == RootRole.Admin && was == RootRole.User ? AdminActions.RootPromote
+					: role == RootRole.User && was == RootRole.Admin ? AdminActions.RootDemote
+					: AdminActions.RootRole, AdminTargets.Root, user.ID, userName, $"{Name(was)} → {Name(role)}");
 
 			output.WriteLine($"{userName}: {string.Join(", ", user.Policies)}");
+			if (was == RootRole.Admin && role != RootRole.Admin
+				&& !await DB.Default.Find<RootUser>().Match(u => u.DeletedAt == null && !u.IsBanned && u.Policies.Contains(Policies.IsAdmin)).ExecuteAnyAsync())
+				Console.Error.WriteLine("no administrator is left: `PrivaPub admin role <root> admin` makes one");
 			return 0;
 		}
 
+		static string Name(RootRole role) => role switch { RootRole.Admin => "admin", RootRole.Moderator => "moderator", _ => "user" };
+
 		// With sign-up closed, this or the client's setup (while no administrator exists) makes the first root; group invitations
 		// make the rest.
 		static async Task<int> CreateRoot(IServiceProvider services, string login, string password, bool admin, TextWriter output)
@@ -234,7 +247,7 @@ namespace PrivaPub.Infrastructure.Cli
 			}
 			var made = await DB.Default.Find<RootUser>().Match(u => u.UserName == login.ToLowerInvariant()).ExecuteFirstAsync();
 			await Log(services, AdminActions.RootCreate, AdminTargets.Root, made?.ID, login.ToLowerInvariant(), admin ? "administrator" : default);
-			return admin ? await Promote(services, true, login, output, created: true) : await Report(login, output);
+			return admin ? await Role(services, login, RootRole.Admin, output, created: true) : await Report(login, output);
 		}
 
 		static Task<int> Report(string login, TextWriter output)