feat(social): asymmetric per-user block, in-game block control, admin lists

Make a per-user block one-directional and non-destructive: the blocker stops
receiving everything from the blocked user (chat, nudge, friend requests,
invitations) and the matchmaker never pairs them, while the blocked user
notices nothing — their sends still persist by the normal rules but are never
delivered or surfaced (born-read). A block no longer deletes the friendship
(an unblock cleanly restores it) and instant-reads any unread the blocked user
had left for the blocker.

- backend: a directional blockExists guard across chat/nudge/friends/invitations
  (store-but-hide for the blocked->blocker direction, refuse blocker->blocked);
  the matchmaker excludes a block-related pair (both directions) from auto-match;
  user_blocked/user_unblocked notifications to the blocker only (in-app only).
- ui: the opponent score card gains a block ✖️ control mirroring add-friend
  (red "Block?" confirm, mutual-hide while confirming, struck name, hidden chat
  composer when blocked); optimistic apply + event confirm + rollback for both.
- admin: the user card gains cross-linked blocks / blocked-by / friends lists.
- docs: FUNCTIONAL(+ru), ARCHITECTURE §10 + decision record, UI_DESIGN, PRERELEASE.

ui/src/game/Chat.svelte

@@ -13,6 +13,7 @@
     waiting = false,
     nudgeOnCooldown = false,
     vsAi = false,
+    blocked = false,
     onsend,
     onnudge,
   }: {
@@ -38,6 +39,10 @@
     // vsAi disables both controls in an honest-AI game: the opponent is a robot, so there is
     // nobody to message or hurry. The fields still show (turn-driven), but disabled.
     vsAi?: boolean;
+    // blocked hides the whole composer (message field, send and nudge), leaving only the chat
+    // log — as in a finished game — when the viewer has blocked the opponent: there is no one
+    // they will message (the backend rejects it too).
+    blocked?: boolean;
     onsend: (text: string) => void;
     onnudge: () => void;
   } = $props();
@@ -65,6 +70,7 @@
       {/if}
     {/each}
   </div>
+  {#if !blocked}
   <div class="input">
     {#if canSend}
       <input
@@ -85,6 +91,7 @@
       <button class="iconbtn" onclick={onnudge} disabled={busy || waiting || nudgeOnCooldown || vsAi || !connection.online} aria-label={t('chat.nudgeAction')}>🛎️</button>
     {/if}
   </div>
+  {/if}
 </div>
 
 <style>

ui/src/game/ChatScreen.svelte

@@ -16,6 +16,9 @@
   let messages = $state<ChatMessage[]>([]);
   let busy = $state(false);
   let tick = $state(0);
+  // The opponents the viewer has blocked: when every opponent is blocked the composer is hidden
+  // (only the chat log remains), matching the backend guard that rejects messaging a blocked peer.
+  let blockedIds = $state(new Set<string>());
 
   const myId = $derived(app.session?.userId ?? '');
   const isMyTurn = $derived(
@@ -31,6 +34,14 @@
   const canNudge = $derived(!!view && view.game.status === 'active' && view.game.toMove !== view.seat);
   // While the auto-match game still has no opponent, chat and nudge are both disabled.
   const waiting = $derived(!!view && view.game.status === 'open');
+  // peerBlocked is true when every seated opponent is one the viewer has blocked: the whole
+  // composer is then hidden (a blocked opponent cannot be messaged).
+  const peerBlocked = $derived.by(() => {
+    const v = view;
+    if (!v) return false;
+    const opponents = v.game.seats.filter((s) => s.seat !== v.seat && !!s.accountId);
+    return opponents.length > 0 && opponents.every((s) => blockedIds.has(s.accountId));
+  });
   const nudgeCooldownSecs = 3600;
   // The nudge is one-per-hour-per-game and clears once the player chats (engagement); the
   // backend stays authoritative, so a move-based reset is left to it.
@@ -64,9 +75,20 @@
       if (initial) handleError(e);
     }
   }
+  // loadBlocked refreshes the viewer's blocked set (best-effort); guests have none.
+  async function loadBlocked() {
+    if (app.profile?.isGuest) return;
+    try {
+      const bl = await gateway.blocksList();
+      blockedIds = new Set(bl.map((b) => b.accountId));
+    } catch {
+      /* best-effort */
+    }
+  }
   onMount(async () => {
     await loadState(true);
     await refresh();
+    void loadBlocked();
   });
 
   // Live: refresh the message list on a chat / nudge for this game, and reload the state on
@@ -84,6 +106,10 @@
     ) {
       void loadState();
     }
+    // A block/unblock applied: re-derive whether the composer should be hidden.
+    if (e.kind === 'notify' && (e.sub === 'user_blocked' || e.sub === 'user_unblocked')) {
+      void loadBlocked();
+    }
   });
   // Re-evaluate the nudge cooldown on a timer so the control re-enables on time.
   $effect(() => {
@@ -123,6 +149,7 @@
   {waiting}
   {nudgeOnCooldown}
   vsAi={!!view && view.game.vsAi}
+  blocked={peerBlocked}
   onsend={sendChat}
   onnudge={nudge}
 />

ui/src/game/Game.svelte

@@ -240,6 +240,7 @@
     }
     void load();
     void loadFriends();
+    void loadBlocked();
   });
 
   // cacheSnapshot returns the open game's current state as a CachedGame for the delta reducers.
@@ -294,6 +295,11 @@
       } else if (e.kind === 'notify' && (e.sub === 'friend_added' || e.sub === 'friend_declined')) {
         // A request the player sent was answered: re-derive the in-game "add friend" state.
         void loadFriends();
+      } else if (e.kind === 'notify' && (e.sub === 'user_blocked' || e.sub === 'user_unblocked')) {
+        // A block/unblock applied (this or another of the viewer's sessions): reconcile the
+        // blocked set — and the friend set, since a block hides a blocked friend — in place.
+        void loadBlocked();
+        void loadFriends();
       }
     });
   });
@@ -869,9 +875,12 @@
     boardPointers.delete(e.pointerId);
     boardSwipe = null;
   }
-  // A closed history clears every per-seat add-friend confirmation.
+  // A closed history clears every per-seat add-friend and block confirmation.
   $effect(() => {
-    if (!historyShown) addConfirm = {};
+    if (!historyShown) {
+      addConfirm = {};
+      blockConfirm = {};
+    }
   });
 
   // Friend state for the in-game "add friend" affordance (the 🤝 in each opponent's score
@@ -881,9 +890,15 @@
   // re-send and disable the 🤝).
   let friends = $state(new Set<string>());
   let requested = $state(new Set<string>());
-  // Per-seat "confirming" flag for the 🤝 → ✅ tap-to-confirm (TapConfirm writes it); while
-  // set, that seat's card shows "Add friend?" in place of the score. Reset when history closes.
+  // `blocked` are the opponents the viewer has blocked: their 🤝 and ✖️ controls disappear and
+  // their name is struck. Derived from the server so it is correct across reloads and live-updates
+  // on a user_blocked / user_unblocked event.
+  let blocked = $state(new Set<string>());
+  // Per-seat "confirming" flags for the 🤝 → ✅ and ✖️ → ✅ tap-to-confirm (TapConfirm writes them);
+  // while set, that seat's card shows "Add friend?" / "Block?" in place of the score, and the
+  // opposite control is hidden so the two never overlap. Reset when history closes.
   let addConfirm = $state<Record<number, boolean>>({});
+  let blockConfirm = $state<Record<number, boolean>>({});
 
   // loadFriends refreshes the friend/outgoing sets for a non-guest; guests have no social
   // surfaces, so the sets stay empty. Best-effort — a failure leaves the previous sets.
@@ -898,12 +913,40 @@
     }
   }
 
+  // loadBlocked refreshes the blocked set for a non-guest. Best-effort.
+  async function loadBlocked() {
+    if (app.profile?.isGuest) return;
+    try {
+      const bl = await gateway.blocksList();
+      blocked = new Set(bl.map((b) => b.accountId));
+    } catch {
+      /* best-effort */
+    }
+  }
+
+  // addFriend and blockUser apply the new relationship optimistically (so the controls and score
+  // caption update the instant the confirm fires) and roll back to the prior state if the command
+  // fails to reach the server. The confirming user_blocked / user_added event then just reconciles
+  // the same state in place (no flicker).
   async function addFriend(accountId: string) {
+    const had = requested.has(accountId);
+    requested = new Set([...requested, accountId]);
     try {
       await gateway.friendRequest(accountId);
-      requested = new Set([...requested, accountId]); // optimistic; reconciled by loadFriends
       showToast(t('friends.requestSent'));
     } catch (e) {
+      if (!had) requested = new Set([...requested].filter((id) => id !== accountId));
+      handleError(e);
+    }
+  }
+
+  async function blockUser(accountId: string) {
+    const had = blocked.has(accountId);
+    blocked = new Set([...blocked, accountId]);
+    try {
+      await gateway.block(accountId);
+    } catch (e) {
+      if (!had) blocked = new Set([...blocked].filter((id) => id !== accountId));
       handleError(e);
     }
   }
@@ -933,9 +976,25 @@
   // (not the still-empty seat of an open game) who is not yet a friend (an already-requested
   // opponent still shows it, but disabled).
   function canAddFriend(accountId: string): boolean {
-    // Never offer add-friend against an AI opponent.
+    // Never offer add-friend against an AI opponent, an existing friend, or a blocked player.
     if (view?.game.vsAi) return false;
-    return !!accountId && !app.profile?.isGuest && accountId !== app.session?.userId && !friends.has(accountId);
+    return (
+      !!accountId &&
+      !app.profile?.isGuest &&
+      accountId !== app.session?.userId &&
+      !friends.has(accountId) &&
+      !blocked.has(accountId)
+    );
+  }
+
+  // canBlock reports whether a seat shows the ✖️ block control: like canAddFriend, but a friend
+  // may still be blocked (the block overrides the friendship), so it omits the friend exclusion.
+  // An already-blocked opponent hides it (both controls go, and the name is struck).
+  function canBlock(accountId: string): boolean {
+    if (view?.game.vsAi) return false;
+    return (
+      !!accountId && !app.profile?.isGuest && accountId !== app.session?.userId && !blocked.has(accountId)
+    );
   }
 </script>
 
@@ -985,9 +1044,22 @@
       {#if app.chatUnread[id]}<span class="unread-dot sbadge-dot"></span>{/if}
       {#each view.game.seats as s (s.seat)}
         <div class="seat" class:turn={view.game.toMove === s.seat && !gameOver} class:win={s.isWinner}>
-          <div class="nm">{seatName(s)}</div>
-          <div class="sc">{addConfirm[s.seat] ? t('game.addFriendShort') : s.score}</div>
-          {#if historyShown && canAddFriend(s.accountId)}
+          <div class="nm" class:struck={blocked.has(s.accountId)}>{seatName(s)}</div>
+          <div class="sc" class:blockprompt={blockConfirm[s.seat]}>
+            {#if blockConfirm[s.seat]}{t('game.blockShort')}{:else if addConfirm[s.seat]}{t('game.addFriendShort')}{:else}{s.score}{/if}
+          </div>
+          {#if historyShown && canBlock(s.accountId) && !addConfirm[s.seat]}
+            <span class="blockuser">
+              <TapConfirm
+                label={t('friends.blockFromGame')}
+                onConfirming={(v) => (blockConfirm[s.seat] = v)}
+                onconfirm={() => blockUser(s.accountId)}
+              >
+                <span class="fico">✖️</span>
+              </TapConfirm>
+            </span>
+          {/if}
+          {#if historyShown && canAddFriend(s.accountId) && !blockConfirm[s.seat]}
             <span class="addfriend">
               <TapConfirm
                 label={t('friends.addFromGame')}
@@ -1426,9 +1498,25 @@
     transform: translateY(-50%);
     font-size: 1.15rem;
   }
+  /* The ✖️ block control mirrors add-friend on the seat's left edge. */
+  .blockuser {
+    position: absolute;
+    left: 2px;
+    top: 50%;
+    transform: translateY(-50%);
+    font-size: 1.15rem;
+  }
   .fico {
     line-height: 1;
   }
+  /* A blocked opponent's name is struck through. */
+  .nm.struck {
+    text-decoration: line-through;
+  }
+  /* The "Block?" confirm caption replaces the score in the danger colour (theme-aware). */
+  .sc.blockprompt {
+    color: var(--danger);
+  }
   /* The unread-chat dot on the score bar's corner; the history's 💬 icon fade-blinks (two cycles)
      when the history is opened with unread present, rather than carrying a count badge. */
   .unread-dot {