feat: per-entity federation privacy toggles for reviews and watchlist

- add federate_reviews + federate_watchlist to UserSettings (default true)
- new UserFederationSettingsQuery port with FederationFlags struct
- remove get_user_federate_goals from LocalApContentQuery
- gate ReviewLogged, ReviewUpdated, WatchlistEntryAdded, on_poster_synced on flags
- goals gating migrated to UserFederationSettingsQuery
- ReviewDeleted and WatchlistEntryRemoved ungated (tombstones always fire)
- sqlite + postgres migrations and adapter impls
- settings API and SPA toggles

crates/presentation/src/factory.rs

@@ -36,6 +36,7 @@ pub struct DatabaseOutput {
     pub wrapup_repo: Arc<dyn domain::ports::WrapUpRepository>,
     pub goal: Arc<dyn domain::ports::GoalRepository>,
     pub user_settings: Arc<dyn domain::ports::UserSettingsRepository>,
+    pub federation_settings: std::sync::Arc<dyn domain::ports::UserFederationSettingsQuery>,
     pub remote_goal: Arc<dyn domain::ports::RemoteGoalRepository>,
     pub refresh_session: Arc<dyn RefreshSessionRepository>,
     pub db_pool: DbPool,
@@ -78,6 +79,7 @@ pub async fn build_database_adapters(backend: &str, url: &str) -> anyhow::Result
                 wrapup_repo: w.wrapup_repo,
                 goal: w.goal,
                 user_settings: w.user_settings,
+                federation_settings: w.federation_settings,
                 remote_goal: w.remote_goal,
                 refresh_session: Arc::new(postgres::PostgresRefreshSessionAdapter::new(
                     w.pool.clone(),
@@ -119,6 +121,7 @@ pub async fn build_database_adapters(backend: &str, url: &str) -> anyhow::Result
                 wrapup_repo: w.wrapup_repo,
                 goal: w.goal,
                 user_settings: w.user_settings,
+                federation_settings: w.federation_settings,
                 remote_goal: w.remote_goal,
                 refresh_session: Arc::new(sqlite::SqliteRefreshSessionAdapter::new(w.pool.clone()))
                     as _,

crates/presentation/src/handlers/goals.rs

@@ -176,6 +176,8 @@ pub async fn get_settings(
     .await?;
     Ok(Json(UserSettingsDto {
         federate_goals: settings.federate_goals(),
+        federate_reviews: settings.federate_reviews(),
+        federate_watchlist: settings.federate_watchlist(),
     }))
 }
 
@@ -198,6 +200,8 @@ pub async fn update_settings(
         application::users::update_settings::UpdateUserSettingsCommand {
             user_id: user.0.value(),
             federate_goals: req.federate_goals,
+            federate_reviews: req.federate_reviews,
+            federate_watchlist: req.federate_watchlist,
         },
     )
     .await?;

crates/presentation/src/main.rs

@@ -119,6 +119,7 @@ async fn wire_dependencies() -> anyhow::Result<(AppState, axum::Router)> {
             remote_goal_repo: Arc::clone(&db.remote_goal),
             local_ap_content: Arc::clone(&ap_content_repo),
             user_repo: Arc::clone(&db.user),
+            federation_settings: std::sync::Arc::clone(&db.federation_settings),
             base_url: app_config.base_url.clone(),
             allow_registration: app_config.allow_registration,
             event_publisher: Arc::clone(&ep),