R7 custom emoji: the server's own, added by administrators, sent on posts, profiles and reactions

LocalEmoji, a new collection (unique shortcode whatever its case, never renamed: the shortcode is its id elsewhere),
managed on /clientapi/admin/emoji/list|insert|update|delete and kept in the staff's log (emoji.insert, .update,
.delete). Its picture goes through IMediaService.EmojiImage: PNG, GIF, WebP or JPEG up to 256 KB, a PNG within 256 px
with alpha kept (an animated GIF or WebP stays an animated GIF, with a still PNG), keep=none, shrunk until it fits
GoToSocial's 100 KiB, held by ServerUse "emoji:<shortcode>" so the janitor and the audit leave it. LocalEmojis keeps the
offered ones in memory, reloaded on every change: GET /api/v1/custom_emojis is real; local posts (words, title, warning,
poll options, each revision) and profiles keep the emoji they name; Notes, Questions, actors and EmojiReacts carry
Mastodon's Emoji tag with its id, served as an Emoji at /emojis/{shortcode} (410 once deleted; the path awaits the
owner's confirmation); a persona reacts with one (Pleroma's reactions, announcements). A restore keeps the live emoji
as it keeps the settings, and trashes server pictures nothing holds. tools/pasture/scenarios/emoji.sh joins batch A.

Verified: built, and run locally against a scratch database (uploads of every type, animation kept, metadata gone,
refusals, rendering, reactions, history, announcements, delete and revive, backup and restore, media audit). The
pasture scenario and the sweep were not run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

docs/ROADMAP.md

@@ -126,6 +126,18 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
     meanwhile), still counts among the users (counts tell nothing new), leaves a follow request unanswered, and its
     scheduled posts wait; a suspended account elsewhere may still delete or undo what it sent; deleting a group asks its
     owner's password, like deleting a persona.
+  - R7 custom emoji (built 2026-10-17, not yet deployed; `tools/pasture/scenarios/emoji.sh`): the server's own emoji
+    (`LocalEmoji`), added, changed and deleted by an administrator on `/clientapi/admin/emoji` and kept in the staff's log;
+    `GET /api/v1/custom_emojis`; taken into local posts (words, title, warning, poll options), profiles (name, bio, fields)
+    and reactions (Pleroma's reactions and announcements), sent as Mastodon's `Emoji` tags on Notes, Questions, actors and
+    `EmojiReact`s, each served as an `Emoji` at its id `/emojis/{shortcode}`. Chosen while building it, for the owner to
+    confirm: **the id's path `/emojis/{shortcode}`** (the plan's name, defined once as `LocalEmojis.Path`; it freezes once
+    federated); an emoji is never renamed (its shortcode is its id); its picture is a PNG within 256 px, or an animated GIF
+    (an animated WebP becomes one too), made smaller until it fits GoToSocial's 100 KiB; `custom_emojis` lists only those
+    in the picker, as Mastodon does; a disabled emoji is kept but offered and rendered nowhere (its id 404), a deleted one
+    410; what posts and profiles render is the emoji as they are now, and no `Update` is sent when one changes; its id is
+    served unsigned under SecureMode; a restore keeps the live emoji, as it keeps the settings (one deleted since stays
+    deleted).
 
 ## Intent
 
@@ -588,7 +600,8 @@ The first refactor commit is a pure move with namespaces only. Logic changes fol
     (server-sent events): `user`, `user:notification`, `public`, `public:local`, `public:remote`, `hashtag`,
     `hashtag:local`, `list`; events `update`, `notification`, `status.update`, `delete`; `health`. Advertised as
     `urls.streaming`.
-  - **Stubs:** `custom_emojis`, announcements, suggestions, preferences.
+  - **Stubs:** `custom_emojis`, announcements, suggestions, preferences. *Announcements are real since R5,
+    `custom_emojis` since R7 (2026-10-17).*
 - **Mapping:**
   - Avatar, ForeignAvatar and Group all map to Account (`group: true` for groups). `acct` uses a WebFinger-verified
     handle; `created_at` is truncated to the day; avatar and header always have a placeholder URL.