feat: discoverability (NodeInfo, hashtags) and moderation (domain/actor blocking)

- NodeInfo at /.well-known/nodeinfo + /nodeinfo/2.0
- Hashtags #MoviesDiary + #MovieTitle on review posts; /tags/{tag} redirect
- Domain blocking: blocked_domains table, admin API + HTML, inbox enforcement
- Per-actor blocking: blocked_actors table, user API + HTML, BlockActivity send/receive
- Delivery filter excludes blocked actors and blocked-domain inboxes

crates/adapters/template-askama/templates/followers.html

@@ -20,6 +20,11 @@
     <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
     <button type="submit">Remove</button>
   </form>
+  <form method="POST" action="/social/block" style="display:inline">
+    <input type="hidden" name="actor_url" value="{{ actor.url }}">
+    <input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
+    <button type="submit">Block</button>
+  </form>
 </li>
 {% endfor %}
 </ul>