Add Spoiler Flag with veil, AP content-warning encoding, and full-stack plumbing

Authors can flag a review's comment as containing spoilers; the comment is
blurred behind a reveal control for every viewer except the author, omitted
from RSS, and federates as containsSpoilers plus an AP summary content
warning (ADR-0011) so Mastodon-class clients also collapse it. Flag follows
the general-edit path (ADR-0001) across domain, both DB backends, REST,
HTML templates, SPA (shadcn), TUI fixtures, and exports.

crates/application/src/diary/tests/log_review.rs

@@ -67,6 +67,7 @@ async fn test_log_review_creates_movie_and_review() {
         comment: None,
         watched_at: Utc::now().naive_utc(),
         watch_medium: None,
+        spoilers: false,
     };
 
     log_review::execute(&logger, cmd).await.unwrap();
@@ -100,6 +101,7 @@ async fn test_log_review_reuses_existing_movie() {
         comment: None,
         watched_at: Utc::now().naive_utc(),
         watch_medium: None,
+        spoilers: false,
     };
 
     log_review::execute(&logger, cmd).await.unwrap();
@@ -122,6 +124,7 @@ async fn test_log_review_with_invalid_rating_fails() {
         comment: None,
         watched_at: Utc::now().naive_utc(),
         watch_medium: None,
+        spoilers: false,
     };
     let result = log_review::execute(&logger, cmd).await;
     assert!(result.is_err(), "rating > 5 should fail");