Add Spoiler Flag with veil, AP content-warning encoding, and full-stack plumbing

Authors can flag a review's comment as containing spoilers; the comment is
blurred behind a reveal control for every viewer except the author, omitted
from RSS, and federates as containsSpoilers plus an AP summary content
warning (ADR-0011) so Mastodon-class clients also collapse it. Flag follows
the general-edit path (ADR-0001) across domain, both DB backends, REST,
HTML templates, SPA (shadcn), TUI fixtures, and exports.

docs/adr/0011-spoiler-flag-federation-encoding.md

@@ -0,0 +1,9 @@
+# Spoiler Flag federates as both a boolean field and a summary content warning
+
+Reviews marked with the Spoiler Flag serialize on the ActivityPub Note as `containsSpoilers: true` alongside `summary: "Contains spoilers"`. The boolean is the source of truth for Movies-Diary peers; the summary exists so Mastodon-class clients — which render any Note summary as a collapsed content warning — also protect their users instead of showing the spoiler raw. Inbound parsing trusts the boolean only (review Notes always originate from Movies-Diary instances, gated by the `review: true` discriminator), so unrelated summaries from other apps are never misread as spoiler flags.
+
+## Considered Options
+
+- **Boolean field only** — consistent with `watchMedium`, but Mastodon followers saw the full spoiler text raw; the feature silently failed for half the audience.
+- **Summary-only** (presence = flag) — rejected because "any summary means spoiler" breaks if reviews ever gain titles or other apps content-warn for other reasons.
+- **Emitting neither and relying on veiling at the source** — rejected; the flag must travel with the object or remote instances cannot protect their own viewers.