[MOD-001] Add report, block, and safety actions

[chev0004]

Outline

Summary

Turns the discovery card's Report and Block menu actions into real safety workflows: reports are stored for moderation, blocks are user scoped and hide a blocked user's profiles from discovery, and both actions require login and are reversible.

---

Changes & Enhancements

• Type of Change:
  • Feature
  • Bugfix
  • Refactor
  • Chore
• Changes:
  • (database):
    • Add append-only reports table (reason, optional details, status) and user scoped user_blocks table, with self report/self block check constraints and a migration.
  • (api):
    • Add POST /api/report and POST/DELETE /api/block, each gated on login, validating input and rejecting self actions.
  • (discovery):
    • Add a report dialog (reason picker plus optional details), block with an undo toast, and exclude blocked users from the discovery feed server side.
  • (public profile):
    • Wire the same report dialog and block action into the public profile card.
  • (toast):
    • Allow React node toast descriptions so the block toast can offer an inline Undo.

---

Page / App Changes

Affected Next.js Routes (Local):

• /[lang] (discovery feed): blocked users are excluded; Report and Block now run real workflows.
• /[lang]/u/[id] (public profile): Report and Block actions wired up.

Before (Screenshot)

After (Screenshot)

---

Component / Storybook Changes

Affected Storybook Components (Local):

• Discovery > ProfileCard > MenuOpen
• Discovery > ReportDialog > Default
• Discovery > ReportDialog > ReasonSelected
• Components > Toast > BlockUndo

Before (Screenshot)

After (Screenshot)

Card menu safety actions:

Report dialog:

Block confirmation with undo:

---

Not Doing

• Admin moderation dashboard and automated abuse detection (tracked separately).
• Standalone blocked users management page; unblock is available via the undo toast.

---

Other (Remarks)

Safety storage reads tolerate the tables not yet existing, so the feed keeps working before the migration runs. Verified the persistence path against the local database: blocking hides a profile from discovery, reports are stored, and unblock reverses the block.

---

Checklists

• Code is well-documented (comments, JSDoc, etc.).
• Existing comments were updated as needed.
• No out-of-scope changes are included.
• Write TODO comments where future work is required.
• Removed unnecessary debug code (e.g., console.log, debugger).
• Self-reviewed and tested locally.