Add Spoiler Flag with veil, AP content-warning encoding, and full-stack plumbing

Authors can flag a review's comment as containing spoilers; the comment is
blurred behind a reveal control for every viewer except the author, omitted
from RSS, and federates as containsSpoilers plus an AP summary content
warning (ADR-0011) so Mastodon-class clients also collapse it. Flag follows
the general-edit path (ADR-0001) across domain, both DB backends, REST,
HTML templates, SPA (shadcn), TUI fixtures, and exports.

spa/src/features/movies.ts

@@ -26,11 +26,13 @@ export type MovieStatsDto = z.infer<typeof movieStatsDtoSchema>
 
 export const socialReviewDtoSchema = z.object({
   user_display: z.string(),
+  user_id: z.string(),
   rating: z.number(),
   comment: z.string().optional(),
   watched_at: z.string(),
   is_federated: z.boolean(),
   watch_medium: z.string().optional(),
+  spoilers: z.boolean().optional(),
 })
 export type SocialReviewDto = z.infer<typeof socialReviewDtoSchema>