R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Models/User/RootUser.cs

@@ -25,15 +25,45 @@ namespace PrivaPub.Models.User
 		public RootTotp Totp { get; set; }//two-factor sign-in, when the login set it up (Services/TwoFactor.cs)
 
 		/// <summary>An administrator is a moderator too (IsAdminPolicy asks for both); otherwise a plain user.</summary>
-		public void SetAdmin(bool admin)
+		public void SetAdmin(bool admin) => SetRole(admin ? RootRole.Admin : RootRole.User);
+
+		/// <summary>The login's role, as its policies say it: every login is a user, a moderator is one too, and an
+		/// administrator is all three.</summary>
+		public void SetRole(RootRole role)
 		{
 			Policies.RemoveAll(p => p is ClientModels.Policies.IsAdmin or ClientModels.Policies.IsModerator);
-			if (admin)
-				Policies.AddRange([ClientModels.Policies.IsAdmin, ClientModels.Policies.IsModerator]);
+			if (role is RootRole.Moderator or RootRole.Admin)
+				Policies.Add(ClientModels.Policies.IsModerator);
+			if (role == RootRole.Admin)
+				Policies.Add(ClientModels.Policies.IsAdmin);
 			if (!Policies.Contains(ClientModels.Policies.IsUser))
 				Policies.Add(ClientModels.Policies.IsUser);
 			UpdatedAt = DateTime.UtcNow;
 		}
+
+		public RootRole Role => Policies.Contains(ClientModels.Policies.IsAdmin) ? RootRole.Admin
+			: Policies.Contains(ClientModels.Policies.IsModerator) ? RootRole.Moderator
+			: RootRole.User;
+
+		public static bool TryParseRole(string value, out RootRole role)
+		{
+			role = value?.Trim().ToLowerInvariant() switch
+			{
+				"user" => RootRole.User,
+				"moderator" => RootRole.Moderator,
+				"admin" or "administrator" => RootRole.Admin,
+				_ => (RootRole)(-1)
+			};
+			return Enum.IsDefined(role);
+		}
+	}
+
+	// never stored: a login's role lives in its Policies
+	public enum RootRole
+	{
+		User,
+		Moderator,
+		Admin
 	}
 
 	// TOTP (RFC 6238: 30 s, 6 digits, SHA-1, as every authenticator app reads it). PendingSecret waits for its first code;