feat(admin): manual account blocking (suspensions)

Operator-driven hard block, the counterpart to the soft high-rate flag: permanent or until a date, with an optional reason chosen from an editable en+ru picklist (snapshotted onto the block). A block forfeits the player's active games (opponent wins, as a resignation) and cancels their open matchmaking games. A backend gate refuses a blocked account on every /api/v1/user/* route except the block-status probe with 403 account_blocked, which threads through the gateway as the Execute result_code; the UI surfaces it as a terminal blocked screen and stops all push/poll. Temporary blocks self-expire; the operator can unblock at any time (lost games stay lost). Sessions are not revoked, so the blocked client can still reach the exempt block-status endpoint.

Backend: migration 00003 (account_suspensions + suspension_reasons) + jet regen; account suspension store; game.ForfeitAllForAccount; requireNotSuspended gate + block-status endpoint; admin console block/unblock + Reasons CRUD. Wire: fbs BlockStatus + account.block_status gateway op. UI: blocked screen, app state, transport/codec, i18n. Docs: ARCHITECTURE, FUNCTIONAL(+ru), PRERELEASE (AB).

docs/ARCHITECTURE.md

@@ -700,6 +700,7 @@ promotions) is future work and would deliver short markdown messages (text + lin
 | Session minting; email-code / guest validation | gateway (with backend) |
 | Session → `user_id` resolution, `X-User-ID` injection | gateway |
 | Authorisation, ownership, state transitions | backend (`X-User-ID` is the sole identity input) |
+| Manual account block (suspension) | backend: a per-request gate refuses a blocked account on every `/api/v1/user/*` route except the block-status probe with **403 `account_blocked`**; the operator blocks/unblocks from the admin console (§11) |
 | Admin authentication | a single Basic-Auth gate on `/_gm/*`, forwarded **verbatim** to the backend's server-rendered admin console (and, in the deployed contour, routing `/_gm/grafana/*` to Grafana). In the deploy the **caddy** owns this gate (§13); a local non-caddy run uses the gateway's own `GATEWAY_ADMIN_*` proxy, which the per-IP admin limiter class guards ahead of its Basic-Auth — the caddy-fronted path has no limiter (stock caddy), an accepted gap. The backend trusts the proxy (no admin principal) and guards its state-changing POSTs with a **same-origin** check — the console's CSRF defence. No operator identity is tracked |
 | backend ↔ gateway ↔ connector trust | the network (only gateway may reach backend; the connector serves unauthenticated gRPC on the internal segment) |
 
@@ -707,6 +708,25 @@ This is an explicit, accepted MVP risk: compromise of the gateway↔backend
 network segment defeats backend authentication. Mitigated by network isolation;
 mutual auth is a future hardening step.
 
+**Manual account block (suspension).** Beyond the soft, reversible high-rate flag (§11, never a
+gate), an operator can hard-block an account from the admin console — permanently or until a
+date, with an optional reason chosen from an editable en+ru picklist. A block is a row in
+`account_suspensions` (the chosen reason's text is **snapshotted**, so editing or deleting a
+picklist entry never changes what an already-blocked player is shown); it is named *suspension*
+to stay distinct from the peer-to-peer `blocks` table. Enforcement is a backend middleware gate
+after `X-User-ID`: every `/api/v1/user/*` route except the block-status probe refuses a blocked
+account with **HTTP 403 + code `account_blocked`**, which threads through the gateway unchanged as
+the Execute `result_code`, so the UI detects the block from *any* call and replaces every screen
+with a terminal "blocked" screen, stopping all push/poll. The one exempt route,
+`GET /api/v1/user/block-status`, returns the expiry and the reason resolved to the account's
+language so the blocked client can render the message. Sessions are **not** revoked on block (a
+revoked token would fail session resolution at the gateway *before* the gate, sending the UI to
+login instead of the blocked screen). A block instantly **forfeits** every active game the player
+is in (the opponent wins, exactly as a resignation — the engine resigns off-turn) and cancels
+their open matchmaking games; a temporary block lapses automatically once its expiry passes (no
+sweeper — the gate recomputes against `now`). No operator identity is recorded (shared
+Basic-Auth).
+
 **Short numeric codes** (email confirm-codes and friend codes) are stored
 only as SHA-256 hashes and are short-lived and single-use. The unauthenticated
 email path carries a tight per-IP sub-limit (5 / 10 min); the **friend-code redeem**

docs/FUNCTIONAL.md

@@ -208,3 +208,15 @@ account sustaining rejections past a tunable threshold is flagged automatically
 the marker is reversible, shown as a badge in the user list and on the user card, and
 **never blocks play**; the operator reviews and clears it from the user card. There is
 no automatic ban.
+
+The console also lets an operator **manually block** an account — the hard counterpart to the
+soft high-rate flag. From the user card the operator blocks the account **permanently** or
+**until a date** (presets: 1 day / 3 days / 1 week / 1 month, or a custom date in UTC), optionally
+citing a **reason** chosen from an editable **en+ru picklist** managed on a **Reasons** page; the
+blocked player sees the reason in their own language. Blocking instantly **forfeits** the player's
+active games (each opponent wins, as if the player resigned) and removes them from matchmaking. A
+blocked player — on opening the app or on any action — is shown a terminal screen: *"Your account
+is blocked"* (permanent) or *"…blocked until <date, time>"* (temporary, in their timezone),
+plus the reason when one was given, and the app stops all background traffic with the server. A
+temporary block lifts itself when it expires; the operator can also **unblock** from the user card
+at any time (games already lost stay lost).

docs/FUNCTIONAL_ru.md

@@ -213,3 +213,16 @@ Telegram-identity) или **отправить пост в игровой кан
 автоматически — маркер обратим, виден бейджем в списке пользователей и на карточке
 аккаунта и **никогда не блокирует игру**; оператор рассматривает и снимает его с
 карточки пользователя. Автоматического бана нет.
+
+Консоль также позволяет оператору **вручную заблокировать** аккаунт — жёсткий аналог мягкого
+high-rate флага. С карточки пользователя оператор блокирует аккаунт **навсегда** или **до даты**
+(пресеты: 1 день / 3 дня / 1 неделя / 1 месяц либо произвольная дата в UTC), при желании указав
+**причину** из редактируемого **списка en+ru**, который ведётся на странице **Reasons**;
+заблокированный игрок видит причину на своём языке. Блокировка мгновенно засчитывает **поражение**
+во всех активных партиях игрока (каждый соперник побеждает, как при сдаче) и убирает его из
+матчмейкинга. Заблокированный игрок — при открытии приложения или любом действии — видит
+терминальный экран: *«Ваша учётная запись заблокирована»* (постоянная) или *«…заблокирована до
+<дата, время>»* (временная, в его часовом поясе), плюс причину, если она была указана, и
+приложение прекращает любое фоновое общение с сервером. Временная блокировка снимается сама по
+истечении срока; оператор также может **разблокировать** с карточки пользователя в любой момент
+(уже проигранные партии не возвращаются).