feat: discoverability (NodeInfo, hashtags) and moderation (domain/actor blocking)

- NodeInfo at /.well-known/nodeinfo + /nodeinfo/2.0
- Hashtags #MoviesDiary + #MovieTitle on review posts; /tags/{tag} redirect
- Domain blocking: blocked_domains table, admin API + HTML, inbox enforcement
- Per-actor blocking: blocked_actors table, user API + HTML, BlockActivity send/receive
- Delivery filter excludes blocked actors and blocked-domain inboxes

crates/adapters/template-askama/templates/blocked_actors.html

@@ -0,0 +1,24 @@
+{% extends "base.html" %}
+{% block content %}
+<h2>Blocked Users</h2>
+
+{% if actors.is_empty() %}
+<p>No users blocked.</p>
+{% else %}
+<ul class="following-list">
+  {% for a in actors %}
+  <li class="following-item">
+    {% if let Some(avatar) = a.avatar_url %}
+    <img src="{{ avatar }}" alt="avatar" style="width:32px;height:32px;border-radius:50%" />
+    {% endif %}
+    <strong>{{ a.handle }}</strong>{% if let Some(name) = a.display_name %} ({{ name }}){% endif %}
+    <form method="POST" action="/social/unblock" style="display:inline">
+      <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}" />
+      <input type="hidden" name="actor_url" value="{{ a.url }}" />
+      <button type="submit">Unblock</button>
+    </form>
+  </li>
+  {% endfor %}
+</ul>
+{% endif %}
+{% endblock %}

crates/adapters/template-askama/templates/blocked_domains.html

@@ -0,0 +1,35 @@
+{% extends "base.html" %}
+{% block content %}
+<h2>Blocked Domains</h2>
+
+<form method="POST" action="/admin/blocked-domains">
+  <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}" />
+  <div>
+    <label for="domain">Domain</label>
+    <input id="domain" type="text" name="domain" placeholder="spam.example.com" required />
+  </div>
+  <div>
+    <label for="reason">Reason (optional)</label>
+    <input id="reason" type="text" name="reason" />
+  </div>
+  <button type="submit">Block Domain</button>
+</form>
+
+{% if domains.is_empty() %}
+<p>No domains blocked.</p>
+{% else %}
+<ul>
+  {% for d in domains %}
+  <li>
+    <strong>{{ d.domain }}</strong>{% if let Some(r) = d.reason %} — {{ r }}{% endif %}
+    ({{ d.blocked_at }})
+    <form method="POST" action="/admin/blocked-domains/remove" style="display:inline">
+      <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}" />
+      <input type="hidden" name="domain" value="{{ d.domain }}" />
+      <button type="submit">Unblock</button>
+    </form>
+  </li>
+  {% endfor %}
+</ul>
+{% endif %}
+{% endblock %}

crates/adapters/template-askama/templates/followers.html

@@ -20,6 +20,11 @@
     <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
     <button type="submit">Remove</button>
   </form>
+  <form method="POST" action="/social/block" style="display:inline">
+    <input type="hidden" name="actor_url" value="{{ actor.url }}">
+    <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
+    <button type="submit">Block</button>
+  </form>
 </li>
 {% endfor %}
 </ul>

crates/adapters/template-askama/templates/following.html

@@ -20,6 +20,11 @@
     <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
     <button type="submit">Unfollow</button>
   </form>
+  <form method="POST" action="/social/block" style="display:inline">
+    <input type="hidden" name="actor_url" value="{{ actor.url }}">
+    <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
+    <button type="submit">Block</button>
+  </form>
 </li>
 {% endfor %}
 </ul>