feat(admin): manual account blocking (suspensions)

Operator-driven hard block, the counterpart to the soft high-rate flag: permanent or until a date, with an optional reason chosen from an editable en+ru picklist (snapshotted onto the block). A block forfeits the player's active games (opponent wins, as a resignation) and cancels their open matchmaking games. A backend gate refuses a blocked account on every /api/v1/user/* route except the block-status probe with 403 account_blocked, which threads through the gateway as the Execute result_code; the UI surfaces it as a terminal blocked screen and stops all push/poll. Temporary blocks self-expire; the operator can unblock at any time (lost games stay lost). Sessions are not revoked, so the blocked client can still reach the exempt block-status endpoint.

Backend: migration 00003 (account_suspensions + suspension_reasons) + jet regen; account suspension store; game.ForfeitAllForAccount; requireNotSuspended gate + block-status endpoint; admin console block/unblock + Reasons CRUD. Wire: fbs BlockStatus + account.block_status gateway op. UI: blocked screen, app state, transport/codec, i18n. Docs: ARCHITECTURE, FUNCTIONAL(+ru), PRERELEASE (AB).

backend/internal/game/service.go

@@ -378,6 +378,68 @@ func (svc *Service) Resign(ctx context.Context, gameID, accountID uuid.UUID) (Mo
 	return MoveResult{Move: rec, Game: post}, nil
 }
 
+// ForfeitAllForAccount resigns every game the account is currently playing and cancels every game
+// it has opened but no opponent has joined, returning how many it acted on. It is the game-side
+// effect of an admin block: the blocked player instantly loses each live game (the opponent
+// winning, exactly as a manual resignation) and leaves matchmaking so nobody joins a doomed game.
+// It reuses the per-game resignation path (its lock, commit and live events), so it is safe to
+// call while play continues and is idempotent — an already-resigned or finished game is skipped.
+// A per-game failure is logged and skipped so one bad game does not strand the rest; the
+// turn-timeout sweeper remains the backstop for anything missed in a race.
+func (svc *Service) ForfeitAllForAccount(ctx context.Context, accountID uuid.UUID) (int, error) {
+	games, err := svc.store.ListGamesForAccount(ctx, accountID)
+	if err != nil {
+		return 0, err
+	}
+	count := 0
+	for _, g := range games {
+		if g.Status != StatusActive && g.Status != StatusOpen {
+			continue // a finished game holds no turn to forfeit
+		}
+		acted, err := svc.forfeitOne(ctx, g.ID, accountID)
+		if err != nil {
+			svc.log.Warn("forfeit on block", zap.String("game", g.ID.String()), zap.Error(err))
+			continue
+		}
+		if acted {
+			count++
+		}
+	}
+	return count, nil
+}
+
+// forfeitOne resigns one game on behalf of accountID, or cancels it when it is an open auto-match
+// game still awaiting an opponent. It reports whether it changed the game. A game that has already
+// finished, or in which the account no longer holds a seat, is a benign no-op.
+func (svc *Service) forfeitOne(ctx context.Context, gameID, accountID uuid.UUID) (bool, error) {
+	_, err := svc.Resign(ctx, gameID, accountID)
+	switch {
+	case err == nil:
+		return true, nil
+	case errors.Is(err, ErrNoOpponentYet):
+		// An open game with no opponent cannot be resigned (there is no one to award the win), so
+		// delete it to clear it from the matchmaking pool. If it filled in the race window it is
+		// now active, so resign the seat instead.
+		deleted, derr := svc.store.DeleteOpenGame(ctx, gameID)
+		if derr != nil {
+			return false, derr
+		}
+		if deleted {
+			svc.cache.remove(gameID)
+			return true, nil
+		}
+		if _, err := svc.Resign(ctx, gameID, accountID); err != nil &&
+			!errors.Is(err, ErrFinished) && !errors.Is(err, ErrNoOpponentYet) {
+			return false, err
+		}
+		return true, nil
+	case errors.Is(err, ErrFinished), errors.Is(err, ErrNotAPlayer), errors.Is(err, ErrNotFound):
+		return false, nil
+	default:
+		return false, err
+	}
+}
+
 // GameVariant returns just a game's variant. The edge layer uses it to map wire alphabet
 // indices to concrete letters before delegating to the letter-based play, exchange and
 // word-check methods, keeping a single domain path shared with the robot.

backend/internal/game/store.go

@@ -354,6 +354,26 @@ func (s *Store) SharedGameExists(ctx context.Context, a, b uuid.UUID) (bool, err
 	return len(rows) > 0, nil
 }
 
+// DeleteOpenGame removes a game only while it is still open (an auto-match game awaiting an
+// opponent), reporting whether a row was deleted. The starter's lone seat and any draft cascade
+// away with it. It no-ops (false) once the game has filled and become active, so a caller can
+// fall back to resigning the now-active seat. Used to clear a blocked player from matchmaking.
+func (s *Store) DeleteOpenGame(ctx context.Context, gameID uuid.UUID) (bool, error) {
+	stmt := table.Games.DELETE().WHERE(
+		table.Games.GameID.EQ(postgres.UUID(gameID)).
+			AND(table.Games.Status.EQ(postgres.String(StatusOpen))),
+	)
+	res, err := stmt.ExecContext(ctx, s.db)
+	if err != nil {
+		return false, fmt.Errorf("game: delete open game %s: %w", gameID, err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return false, fmt.Errorf("game: delete open game rows %s: %w", gameID, err)
+	}
+	return n > 0, nil
+}
+
 // ListGamesForAccount loads every game the account is seated in (active and
 // finished), newest first, each joined with its ordered seats. It backs the lobby's
 // "my games" lists.