feat(admin): manual account blocking (suspensions)

Operator-driven hard block, the counterpart to the soft high-rate flag: permanent or until a date, with an optional reason chosen from an editable en+ru picklist (snapshotted onto the block). A block forfeits the player's active games (opponent wins, as a resignation) and cancels their open matchmaking games. A backend gate refuses a blocked account on every /api/v1/user/* route except the block-status probe with 403 account_blocked, which threads through the gateway as the Execute result_code; the UI surfaces it as a terminal blocked screen and stops all push/poll. Temporary blocks self-expire; the operator can unblock at any time (lost games stay lost). Sessions are not revoked, so the blocked client can still reach the exempt block-status endpoint.

Backend: migration 00003 (account_suspensions + suspension_reasons) + jet regen; account suspension store; game.ForfeitAllForAccount; requireNotSuspended gate + block-status endpoint; admin console block/unblock + Reasons CRUD. Wire: fbs BlockStatus + account.block_status gateway op. UI: blocked screen, app state, transport/codec, i18n. Docs: ARCHITECTURE, FUNCTIONAL(+ru), PRERELEASE (AB).

docs/ARCHITECTURE.md

@@ -700,6 +700,7 @@ promotions) is future work and would deliver short markdown messages (text + lin
 | Session minting; email-code / guest validation | gateway (with backend) |
 | Session → `user_id` resolution, `X-User-ID` injection | gateway |
 | Authorisation, ownership, state transitions | backend (`X-User-ID` is the sole identity input) |
+| Manual account block (suspension) | backend: a per-request gate refuses a blocked account on every `/api/v1/user/*` route except the block-status probe with **403 `account_blocked`**; the operator blocks/unblocks from the admin console (§11) |
 | Admin authentication | a single Basic-Auth gate on `/_gm/*`, forwarded **verbatim** to the backend's server-rendered admin console (and, in the deployed contour, routing `/_gm/grafana/*` to Grafana). In the deploy the **caddy** owns this gate (§13); a local non-caddy run uses the gateway's own `GATEWAY_ADMIN_*` proxy, which the per-IP admin limiter class guards ahead of its Basic-Auth — the caddy-fronted path has no limiter (stock caddy), an accepted gap. The backend trusts the proxy (no admin principal) and guards its state-changing POSTs with a **same-origin** check — the console's CSRF defence. No operator identity is tracked |
 | backend ↔ gateway ↔ connector trust | the network (only gateway may reach backend; the connector serves unauthenticated gRPC on the internal segment) |
 
@@ -707,6 +708,25 @@ This is an explicit, accepted MVP risk: compromise of the gateway↔backend
 network segment defeats backend authentication. Mitigated by network isolation;
 mutual auth is a future hardening step.
 
+**Manual account block (suspension).** Beyond the soft, reversible high-rate flag (§11, never a
+gate), an operator can hard-block an account from the admin console — permanently or until a
+date, with an optional reason chosen from an editable en+ru picklist. A block is a row in
+`account_suspensions` (the chosen reason's text is **snapshotted**, so editing or deleting a
+picklist entry never changes what an already-blocked player is shown); it is named *suspension*
+to stay distinct from the peer-to-peer `blocks` table. Enforcement is a backend middleware gate
+after `X-User-ID`: every `/api/v1/user/*` route except the block-status probe refuses a blocked
+account with **HTTP 403 + code `account_blocked`**, which threads through the gateway unchanged as
+the Execute `result_code`, so the UI detects the block from *any* call and replaces every screen
+with a terminal "blocked" screen, stopping all push/poll. The one exempt route,
+`GET /api/v1/user/block-status`, returns the expiry and the reason resolved to the account's
+language so the blocked client can render the message. Sessions are **not** revoked on block (a
+revoked token would fail session resolution at the gateway *before* the gate, sending the UI to
+login instead of the blocked screen). A block instantly **forfeits** every active game the player
+is in (the opponent wins, exactly as a resignation — the engine resigns off-turn) and cancels
+their open matchmaking games; a temporary block lapses automatically once its expiry passes (no
+sweeper — the gate recomputes against `now`). No operator identity is recorded (shared
+Basic-Auth).
+
 **Short numeric codes** (email confirm-codes and friend codes) are stored
 only as SHA-256 hashes and are short-lived and single-use. The unauthenticated
 email path carries a tight per-IP sub-limit (5 / 10 min); the **friend-code redeem**