R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Web/Pages/OAuth/OAuthPages.cs

@@ -112,7 +112,7 @@ namespace PrivaPub.Web.Pages.OAuth
 			var owns = !string.IsNullOrEmpty(avatarId)
 				&& await _dbEntities.RootToAvatars.Match(r => r.RootId == rootId && r.AvatarId == avatarId).ExecuteAnyAsync(token);
 			var avatar = owns ? await _localActors.FindById(LocalActorKind.Person, avatarId, token) : default;
-			if (avatar == default)
+			if (avatar is not { Suspended: false })//a suspended persona signs in nowhere (R6)
 				return await Show(token);
 
 			var identity = new ClaimsIdentity(TokenValidationParameters.DefaultAuthenticationType, Claims.Name, Claims.Role);
@@ -145,7 +145,7 @@ namespace PrivaPub.Web.Pages.OAuth
 			var avatarIds = (await _dbEntities.RootToAvatars.Match(r => r.RootId == rootId).ExecuteAsync(token)).Select(r => r.AvatarId).ToList();
 			var avatars = new List<LocalActor>();
 			foreach (var id in avatarIds)
-				if (await _localActors.FindById(LocalActorKind.Person, id, token) is { } avatar)
+				if (await _localActors.FindById(LocalActorKind.Person, id, token) is { Suspended: false } avatar)
 					avatars.Add(avatar);
 			Avatars = avatars;
 			Parameters = request.GetParameters()

PrivaPub/Web/Pages/Pages.cs

@@ -61,7 +61,7 @@ namespace PrivaPub.Web.Pages
 		public async Task<IActionResult> OnGetAsync(string user, CancellationToken token)
 		{
 			Actor = await _localActors.FindByUserName(user, token);
-			if (Actor is not { IsFederated: true, IsCircle: false } || Actor.IsServerActor)
+			if (Actor is not { IsFederated: true, IsCircle: false, Suspended: false } || Actor.IsServerActor)
 				return NotFound();
 			if (WantsActivityJson())
 				return Redirect(Actor.Uri);
@@ -84,7 +84,7 @@ namespace PrivaPub.Web.Pages
 					continue;
 				if (!authors.TryGetValue(post.GroupUserId, out var author))
 					authors[post.GroupUserId] = author = await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
-				if (author != default)
+				if (author is { Suspended: false })
 					views.Add(PostView.From(post, author));
 			}
 			Posts = views;
@@ -118,6 +118,7 @@ namespace PrivaPub.Web.Pages
 			var posts = await _dbEntities.Posts
 				.Match(p => p.Tags.Contains(Tag) && !p.IsFederatedCopy && p.ReblogOfPostId == null && p.Visibility == PostVisibility.Public)
 				.Match(VisibilityPolicy.IsPublic)
+				.Match(VisibilityPolicy.IsListed)
 				.Sort(p => p.ID, Order.Descending)
 				.Limit(PageSize)
 				.ExecuteAsync(token);
@@ -127,7 +128,7 @@ namespace PrivaPub.Web.Pages
 			{
 				if (!authors.TryGetValue(post.GroupUserId, out var author))
 					authors[post.GroupUserId] = author = await _localActors.FindById(LocalActorKind.Person, post.GroupUserId, token);
-				if (author is { IsFederated: true })
+				if (author is { IsFederated: true, Suspended: false })
 					views.Add(PostView.From(post, author));
 			}
 			Posts = views;
@@ -153,7 +154,7 @@ namespace PrivaPub.Web.Pages
 		public async Task<IActionResult> OnGetAsync(string user, string id, CancellationToken token)
 		{
 			Actor = await _localActors.FindByUserName(user, token);
-			if (Actor is not { IsFederated: true, Kind: LocalActorKind.Person })
+			if (Actor is not { IsFederated: true, Kind: LocalActorKind.Person, Suspended: false })
 				return NotFound();
 			var post = await _dbEntities.Posts
 				.Match(p => p.ID == id && p.GroupUserId == Actor.Id && !p.IsFederatedCopy && p.ReblogOfPostId == null)