R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Web/Pages/OAuth/OAuthPages.cs

@@ -112,7 +112,7 @@ namespace PrivaPub.Web.Pages.OAuth
 			var owns = !string.IsNullOrEmpty(avatarId)
 				&& await _dbEntities.RootToAvatars.Match(r => r.RootId == rootId && r.AvatarId == avatarId).ExecuteAnyAsync(token);
 			var avatar = owns ? await _localActors.FindById(LocalActorKind.Person, avatarId, token) : default;
-			if (avatar == default)
+			if (avatar is not { Suspended: false })//a suspended persona signs in nowhere (R6)
 				return await Show(token);
 
 			var identity = new ClaimsIdentity(TokenValidationParameters.DefaultAuthenticationType, Claims.Name, Claims.Role);
@@ -145,7 +145,7 @@ namespace PrivaPub.Web.Pages.OAuth
 			var avatarIds = (await _dbEntities.RootToAvatars.Match(r => r.RootId == rootId).ExecuteAsync(token)).Select(r => r.AvatarId).ToList();
 			var avatars = new List<LocalActor>();
 			foreach (var id in avatarIds)
-				if (await _localActors.FindById(LocalActorKind.Person, id, token) is { } avatar)
+				if (await _localActors.FindById(LocalActorKind.Person, id, token) is { Suspended: false } avatar)
 					avatars.Add(avatar);
 			Avatars = avatars;
 			Parameters = request.GetParameters()