feat(safety): UGC moderation for App Store Guideline 1.2 compliance

[onamfc]

Implements every precaution Apple required in the 1.2 (Safety – User Generated Content) rejection so the app can be resubmitted.

App

• EULA gate: new onboarding step ("Keep it kind") with zero-tolerance language; users must tap I Agree before phone verification. Acceptance timestamp stored in settings. Softened the "no trace, pure privacy" copy.
• Content filter: obscenity-based filter runs in the create screen before encryption (E2E means the server can never filter). Blocks profanity incl. leet-speak variants.
• Report + Block: actions on the reveal screen for received messages, with reason picker and block follow-up. Incoming pushes from blocked senders are dropped client-side too.
• Settings → Safety: blocked-numbers management + "Report a Problem" mailto support@linkforty.com (in-app developer contact).

Server

• New tables: reports, blocks, banned_phones (auto-created on boot).
• POST /api/reports — reports carry the decrypted text from the reporter's device; optional REPORT_WEBHOOK_URL alert for the 24h SLA.
• POST/DELETE/GET /api/blocks — enforced server-side; blocked senders get a fake success and the message is silently dropped.
• Admin routes (ADMIN_TOKEN header auth): list/resolve reports, ban/unban. Bans reject every authenticated call, refuse OTP re-verification, deregister devices, and purge undelivered messages.

Web

• Terms page: 18+ eligibility, zero-tolerance clause, Reporting/Blocking/Moderation section with 24h commitment.

Verification

• Server + web typecheck clean; app tsc introduces zero new errors (7 pre-existing on main).
• Live smoke test against throwaway Postgres: block → report → admin review → ban → 403 enforcement → silent drop (0 rows stored) → unblock → delivery restored.

Deploy notes

Requires new Railway env vars: ADMIN_TOKEN (required for admin routes), REPORT_WEBHOOK_URL (optional). Deploy server + web before submitting the new binary.