feat: per-entity federation privacy toggles for reviews and watchlist

- add federate_reviews + federate_watchlist to UserSettings (default true)
- new UserFederationSettingsQuery port with FederationFlags struct
- remove get_user_federate_goals from LocalApContentQuery
- gate ReviewLogged, ReviewUpdated, WatchlistEntryAdded, on_poster_synced on flags
- goals gating migrated to UserFederationSettingsQuery
- ReviewDeleted and WatchlistEntryRemoved ungated (tombstones always fire)
- sqlite + postgres migrations and adapter impls
- settings API and SPA toggles

crates/application/src/users/tests/get_settings.rs

@@ -11,5 +11,7 @@ async fn returns_default_settings() {
         .await
         .unwrap();
 
-    assert!(!settings.federate_goals());
+    assert!(settings.federate_goals());
+    assert!(settings.federate_reviews());
+    assert!(settings.federate_watchlist());
 }

crates/application/src/users/tests/update_settings.rs

@@ -13,7 +13,31 @@ async fn updates_federate_goals() {
     let settings_repo = InMemoryUserSettingsRepository::new();
     let b = TestContextBuilder::new().with_user_settings(Arc::clone(&settings_repo) as _);
     let user_settings = b.user_settings_repo.clone();
+    let uid = Uuid::nil();
 
+    crate::users::update_settings::execute(
+        user_settings.clone(),
+        UpdateUserSettingsCommand {
+            user_id: uid,
+            federate_goals: false,
+            federate_reviews: true,
+            federate_watchlist: true,
+        },
+    )
+    .await
+    .unwrap();
+
+    let settings = get_settings::execute(user_settings, uid).await.unwrap();
+    assert!(!settings.federate_goals());
+    assert!(settings.federate_reviews());
+    assert!(settings.federate_watchlist());
+}
+
+#[tokio::test]
+async fn updates_federate_reviews() {
+    let settings_repo = InMemoryUserSettingsRepository::new();
+    let b = TestContextBuilder::new().with_user_settings(Arc::clone(&settings_repo) as _);
+    let user_settings = b.user_settings_repo.clone();
     let uid = Uuid::nil();
 
     crate::users::update_settings::execute(
@@ -21,6 +45,8 @@ async fn updates_federate_goals() {
         UpdateUserSettingsCommand {
             user_id: uid,
             federate_goals: true,
+            federate_reviews: false,
+            federate_watchlist: true,
         },
     )
     .await
@@ -28,4 +54,31 @@ async fn updates_federate_goals() {
 
     let settings = get_settings::execute(user_settings, uid).await.unwrap();
     assert!(settings.federate_goals());
+    assert!(!settings.federate_reviews());
+    assert!(settings.federate_watchlist());
+}
+
+#[tokio::test]
+async fn updates_federate_watchlist() {
+    let settings_repo = InMemoryUserSettingsRepository::new();
+    let b = TestContextBuilder::new().with_user_settings(Arc::clone(&settings_repo) as _);
+    let user_settings = b.user_settings_repo.clone();
+    let uid = Uuid::nil();
+
+    crate::users::update_settings::execute(
+        user_settings.clone(),
+        UpdateUserSettingsCommand {
+            user_id: uid,
+            federate_goals: true,
+            federate_reviews: true,
+            federate_watchlist: false,
+        },
+    )
+    .await
+    .unwrap();
+
+    let settings = get_settings::execute(user_settings, uid).await.unwrap();
+    assert!(settings.federate_goals());
+    assert!(settings.federate_reviews());
+    assert!(!settings.federate_watchlist());
 }

crates/application/src/users/update_settings.rs

@@ -5,6 +5,8 @@ use domain::{errors::DomainError, ports::UserSettingsRepository, value_objects::
 pub struct UpdateUserSettingsCommand {
     pub user_id: uuid::Uuid,
     pub federate_goals: bool,
+    pub federate_reviews: bool,
+    pub federate_watchlist: bool,
 }
 
 pub async fn execute(
@@ -14,6 +16,8 @@ pub async fn execute(
     let uid = UserId::from_uuid(cmd.user_id);
     let mut settings = user_settings.get(&uid).await?;
     settings.set_federate_goals(cmd.federate_goals);
+    settings.set_federate_reviews(cmd.federate_reviews);
+    settings.set_federate_watchlist(cmd.federate_watchlist);
     user_settings.save(&settings).await
 }