feat(admin): manual account blocking (suspensions)

Operator-driven hard block, the counterpart to the soft high-rate flag: permanent or until a date, with an optional reason chosen from an editable en+ru picklist (snapshotted onto the block). A block forfeits the player's active games (opponent wins, as a resignation) and cancels their open matchmaking games. A backend gate refuses a blocked account on every /api/v1/user/* route except the block-status probe with 403 account_blocked, which threads through the gateway as the Execute result_code; the UI surfaces it as a terminal blocked screen and stops all push/poll. Temporary blocks self-expire; the operator can unblock at any time (lost games stay lost). Sessions are not revoked, so the blocked client can still reach the exempt block-status endpoint.

Backend: migration 00003 (account_suspensions + suspension_reasons) + jet regen; account suspension store; game.ForfeitAllForAccount; requireNotSuspended gate + block-status endpoint; admin console block/unblock + Reasons CRUD. Wire: fbs BlockStatus + account.block_status gateway op. UI: blocked screen, app state, transport/codec, i18n. Docs: ARCHITECTURE, FUNCTIONAL(+ru), PRERELEASE (AB).

docs/FUNCTIONAL.md

@@ -208,3 +208,15 @@ account sustaining rejections past a tunable threshold is flagged automatically
 the marker is reversible, shown as a badge in the user list and on the user card, and
 **never blocks play**; the operator reviews and clears it from the user card. There is
 no automatic ban.
+
+The console also lets an operator **manually block** an account — the hard counterpart to the
+soft high-rate flag. From the user card the operator blocks the account **permanently** or
+**until a date** (presets: 1 day / 3 days / 1 week / 1 month, or a custom date in UTC), optionally
+citing a **reason** chosen from an editable **en+ru picklist** managed on a **Reasons** page; the
+blocked player sees the reason in their own language. Blocking instantly **forfeits** the player's
+active games (each opponent wins, as if the player resigned) and removes them from matchmaking. A
+blocked player — on opening the app or on any action — is shown a terminal screen: *"Your account
+is blocked"* (permanent) or *"…blocked until <date, time>"* (temporary, in their timezone),
+plus the reason when one was given, and the app stops all background traffic with the server. A
+temporary block lifts itself when it expires; the operator can also **unblock** from the user card
+at any time (games already lost stay lost).