R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

docs/ROADMAP.md

@@ -117,6 +117,15 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
   accounts (email, recovery, sessions, TOTP); the client catching up; the server's own settings; moderation; custom
   emoji; the Mastodon API made real; Web Push; P7's communities; P8's signatures; the long tail with HEIC/HEIF;
   hosting events; town drivers for every peer; public `/stargazing` and Bluesky bridging; the close-out.
+  - R6 moderation (built 2026-10-17, not yet deployed; `tools/pasture/scenarios/moderation.sh`): roles (user, moderator,
+    administrator) from the client and `admin role`; silencing and suspending personas and accounts elsewhere
+    (`Post.AuthorLimited`/`AuthorSuspended`), a silenced server's posts limited too; bans held in memory, never written on
+    the personas; posts removed (ours deleted, copies hidden); a persona and a group deleted on their own; reports
+    resolved with an act; every act in the staff's log. Chosen while building it, for the owner to confirm: a suspended
+    persona is warned with Mastodon's `moderation_warning` (read once it is lifted; its login sees it suspended
+    meanwhile), still counts among the users (counts tell nothing new), leaves a follow request unanswered, and its
+    scheduled posts wait; a suspended account elsewhere may still delete or undo what it sent; deleting a group asks its
+    owner's password, like deleting a persona.
 
 ## Intent
 
@@ -346,7 +355,7 @@ statistics and Bluesky bridging, R16 the close-out.
 | Approved | **Web Push, the public `/stargazing` statistics, per-persona Bluesky bridging, email recovery in the client, local custom emoji, admin endpoints in production.** |
 | Built after all | **Hosting events, HEIC/HEIF uploads, town drivers for every peer.** Discourse, NeoDB and Loops peers stay out. |
 | Two-factor | **TOTP, right after email recovery** (R3). |
-| A suspended local persona | **Tells other servers nothing new**: its posts and collections answer 404 and nothing is delivered from it; the actor stays as it is, so lifting the suspension is clean. |
+| A suspended local persona | **Tells other servers nothing new**: its posts and collections answer 404 and nothing is delivered from it; the actor stays as it is, so lifting the suspension is clean. (Built in R6, see FEDERATION.md, Moderation.) |
 | Releases | **Pushed to master, not tagged**: the owner tags when they choose. |
 | Cut | FASP; rewriting HLS playlists; `Announce(object)` per peer; cross-post detection, PieFed's genAI flag, accepted answers and batched Announces; Ed25519 inbound RFC 9421; typed book reviews; the `Api/ClientApi` folder move; Pleroma `Listen` and `acceptsChatMessages` out; Owncast live state; a dislikes collection; Lemmy's `removeData`; translation; the Mastodon admin API; `POST /api/v1/accounts`; S3. |