Settings, Administration and conversations; threads that fill in

Settings, which held only the theme, now belong to the persona too:
- its profile (update_credentials, a new PATCH in IHttpService): pictures,
  name, biography and fields as written, locked, bot, discoverable,
  indexable, and how its posts start (visibility, language, sensitive
  media, who may quote them); the composer starts at that visibility;
- the root's personas, each used in turn, and a new one made;
- the accounts it muted or blocked and the servers it blocked, each undone
  there, a server blocked from a pasted address or handle;
- its follows, lists, blocks, mutes, blocked servers and bookmarks exported
  and imported as the CSV files Mastodon writes (PortabilityService): an
  import resolves each row through PrivaPub, one at a time, and can stop.

Administration opens to moderators: reports, resolved there; and for
administrators the servers blocked for everyone and the federation
statistics (traffic by server, delivery success and latency, the crawler).

The Direct tab pages conversations, badges the unread ones, and a card
marks one read or takes it off the list; opening one reads it.

A remote thread is read again 4 and 15 seconds after it opens, since
PrivaPub then fetches the replies its servers hold. A thread its
community locked shows a lock instead of a reply button, reactions stay
visible below a content warning, and a searched handle opens its
account's profile whatever else matched.

The e2e tests cover each: the profile saved and read back, a persona made,
servers blocked and imported, follows exported, an instance block and the
statistics as the pasture's admin, a conversation read and removed, and a
reply only Mastodon held appearing in its thread.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

CLAUDE.md

@@ -112,6 +112,7 @@ Ionicons 4.5 (`wwwroot/vendor/ionicons.min.css`, `<i class="ion-md-...">`) is lo
   - picking a hue leaves grey.
 - `AppStatusService.IsDarkTheme()` tells which variant is showing.
 - Settings → General edits every theme setting. NavMenu's toggle and slider are shortcuts to the dark and hue ones.
+  The other sections of Settings belong to the persona (see **Settings** under PrivaPub wiring).
 - `Styles/neo.css` holds the neumorphic layer:
   - `neo-raised` / `neo-inset` / `neo-flat`, with sizes `neo-2xs` / `neo-xs` / `neo-sm` / `neo-md` (these replace the
     old `neomorph is-nxsmall` classes);
@@ -187,9 +188,9 @@ supplies:
 - It also picks the JSON: `SUtility.MastodonSerializer` (snake_case, `MastodonJsonContext`) for `api/` and `oauth/`,
   `SUtility.DefaultSerializer` (camelCase, enums by name like PrivaPub, `ClientJsonContext`) for `clientapi/`. A payload
   can be an object (JSON), name/value pairs (a form) or a `Func<HttpContent>` (multipart), built once per attempt.
-- Auth levels: `Get` / `Post` / `Delete` need credentials and end the session when PrivaPub refuses them; `GetAnon` /
-  `PostAnon` add them when there are some; `*TotallyAnon` send none (the login must not carry a JWT: PrivaPub
-  redirects it).
+- Auth levels: `Get` / `Post` / `Put` / `Patch` / `Delete` need credentials and end the session when PrivaPub refuses
+  them; `GetAnon` / `PostAnon` add them when there are some; `*TotallyAnon` send none (the login must not carry a JWT:
+  PrivaPub redirects it).
 - `retryOnError` backoff: 1, 2, 4, 8, 16, 29 s, then 60 s, for at most 10 minutes.
 - Failures never throw. They come back as responses carrying an invalid `WebResult`, with an `ErrorCode` from
   `Models/FailureCodes.cs`; a cancelled request comes back as HTTP 410.
@@ -213,7 +214,9 @@ supplies:
   block, mute, follow requests, `/api/v2/search`, whose handles and URLs PrivaPub resolves), `ListService` (the
   persona's lists and their members; members are only accounts it follows, found with `accounts/search?following=true`),
   `FilterService` (the persona's v2 filters, their keywords and filtered posts), `DiscoveryService` (hashtags and
-  following them, trends, the directory), `MediaService` (uploads), `GroupService`, `InstanceService` and `ProvenanceService`.
+  following them, trends, the directory), `PortabilityService` (Mastodon's CSV exports and imports), `AdminService`
+  (`/clientapi/moderator` and `/clientapi/admin`), `MediaService` (uploads), `GroupService`, `InstanceService` and
+  `ProvenanceService`.
 - **Reactions and votes are public** (owner decision, PrivaPub's ROADMAP): before a persona's first reaction or poll
   vote, `PublicNoticeService` asks it once (`PublicNoticeHost` in `MainLayout`) and remembers the persona in
   localStorage (`PublicActionNotices`). Anything else that makes a persona's act visible to others gets the same notice.
@@ -231,6 +234,18 @@ supplies:
 - **The composer** (`Components/Composer.razor`) writes a post, a reply (`InReplyTo`), a quote (`Quoting`, offered on a
   card when the server says the persona may quote it) or an edit of the persona's own post (`Editing`: its words and
   warning from `/source`, a PUT that keeps its media, visibility and poll); a post can hold a poll instead of media.
+- **Threads** (`Pages/ExpandMessage.razor` at `/expand/{id}`): opening a remote thread makes PrivaPub read its replies
+  from their servers (its FEP-7888 `context`, else `replies`), so the page reads the thread again after 4 and 15 seconds
+  and adds what was found, in the thread's order.
+- **Settings** (`Pages/Settings.razor`, `Components/Settings/`): the persona's profile (`ProfileEditor`:
+  `update_credentials` as multipart, its words as written from `Account.Source`, pictures, fields, locked, bot,
+  discoverable, indexable and posting defaults; the composer starts a new post at its default visibility), its mutes,
+  blocks and blocked servers (`MutesAndBlocks`), and `DataTransfer`: follows, lists, blocks, mutes, blocked servers
+  and bookmarks exported and imported as the CSV files Mastodon writes, so a persona moves between servers. An import
+  resolves each row through PrivaPub and acts one row at a time; it can be stopped.
+- **Administration** (`Pages/Administration.razor`, `Components/Admin/`, for moderators): reports, then for
+  administrators the servers blocked for everyone and the federation statistics. PrivaPub has no admin list of users,
+  and adding an admin endpoint waits for the owner, so the Users section stays empty.
 - **Scheduled posts** (`Pages/Scheduled.razor` at `/scheduled`): the composer's clock button gives a Mastodon API post a
   time (`scheduled_at`, at least five minutes ahead; located and group posts have none); the page moves or drops them.
 - **Explore** (`Pages/Explore.razor` at `/explore`): trending hashtags, posts and links (PrivaPub's, from public posts