The composer completes mentions and hashtags

A mention or hashtag being written at the end of the words is offered, once typing pauses, the accounts or tags
PrivaPub already knows (/api/v2/search, never resolving); a click writes it out. e2e: a town persona's handle,
begun, is offered and completed. CLAUDE.md also says that FEP-5624's moderated comments (PeerTube) show as pending
on a card, as GoToSocial's policies do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

CLAUDE.md

@@ -264,14 +264,16 @@ supplies:
 - **The composer** (`Components/Composer.razor`) writes a post, a reply (`InReplyTo`), a quote (`Quoting`, offered on a
   card when the server says the persona may quote it) or an edit of the persona's own post (`Editing`: its words and
   warning from `/source`, a PUT that keeps its media, visibility and poll); a post can hold a poll instead of media.
+  A mention or hashtag being written at the end of the words is offered what PrivaPub already knows
+  (`/api/v2/search`, never resolving), once typing pauses.
   An edited post's card says so, and its versions open from there (`/statuses/:id/history`, newest first; PrivaPub
   keeps a remote post's earlier versions from its edits and from Pleroma's `formerRepresentations`).
 - **Threads** (`Pages/ExpandMessage.razor` at `/expand/{id}`): opening a remote thread makes PrivaPub read its replies
   from their servers (its FEP-7888 `context`, else `replies`), so the page reads the thread again after 4 and 15 seconds
   and adds what was found, in the thread's order.
-- **Interaction policies** (GoToSocial's): a reply or boost whose target's author must approve it shows so on its card
-  (`privapub.approval`: pending, then nothing once approved, or rejected); one the policy shuts out is refused by
-  PrivaPub (422) and shown as an error.
+- **Interaction policies** (GoToSocial's, and FEP-5624's `canReply` on a PeerTube video whose comments are moderated): a
+  reply or boost whose target's author must approve it shows so on its card (`privapub.approval`: pending, then nothing
+  once approved, or rejected); one the policy shuts out is refused by PrivaPub (422) and shown as an error.
 - **Settings** (`Pages/Settings.razor`, `Components/Settings/`): the login itself (`AccountEditor`: its password changed,
   or the whole of it deleted, every persona with it, through `/clientapi/user/update/password` and `/clientapi/user/delete`;
   the client then signs out), the persona's profile (`ProfileEditor`: