Add Spoiler Flag with veil, AP content-warning encoding, and full-stack plumbing

Authors can flag a review's comment as containing spoilers; the comment is
blurred behind a reveal control for every viewer except the author, omitted
from RSS, and federates as containsSpoilers plus an AP summary content
warning (ADR-0011) so Mastodon-class clients also collapse it. Flag follows
the general-edit path (ADR-0001) across domain, both DB backends, REST,
HTML templates, SPA (shadcn), TUI fixtures, and exports.

crates/adapters/export/src/tests/lib.rs

@@ -62,6 +62,7 @@ fn make_entry_full(
             .and_hms_opt(0, 0, 0)
             .unwrap(),
         None,
+        false,
     )
     .unwrap();
     DiaryEntry::new(movie, review)
@@ -81,7 +82,7 @@ async fn csv_has_header_and_one_row() {
         collect_stream(adapter.stream_entries(entry_stream(vec![entry]), ExportFormat::Csv)).await;
     let text = String::from_utf8(bytes).unwrap();
     assert!(
-        text.starts_with("title,year,director,rating,comment,watched_at,external_metadata_id\n")
+        text.starts_with("title,year,director,rating,comment,watched_at,external_metadata_id,spoilers\n")
     );
     assert!(text.contains("Inception"));
     assert!(text.contains("2010"));
@@ -149,7 +150,7 @@ async fn empty_entries_returns_csv_header_only() {
     let text = String::from_utf8(bytes).unwrap();
     assert_eq!(
         text,
-        "title,year,director,rating,comment,watched_at,external_metadata_id\n"
+        "title,year,director,rating,comment,watched_at,external_metadata_id,spoilers\n"
     );
 }