feat(admin): manual account blocking (suspensions)

Operator-driven hard block, the counterpart to the soft high-rate flag: permanent or until a date, with an optional reason chosen from an editable en+ru picklist (snapshotted onto the block). A block forfeits the player's active games (opponent wins, as a resignation) and cancels their open matchmaking games. A backend gate refuses a blocked account on every /api/v1/user/* route except the block-status probe with 403 account_blocked, which threads through the gateway as the Execute result_code; the UI surfaces it as a terminal blocked screen and stops all push/poll. Temporary blocks self-expire; the operator can unblock at any time (lost games stay lost). Sessions are not revoked, so the blocked client can still reach the exempt block-status endpoint.

Backend: migration 00003 (account_suspensions + suspension_reasons) + jet regen; account suspension store; game.ForfeitAllForAccount; requireNotSuspended gate + block-status endpoint; admin console block/unblock + Reasons CRUD. Wire: fbs BlockStatus + account.block_status gateway op. UI: blocked screen, app state, transport/codec, i18n. Docs: ARCHITECTURE, FUNCTIONAL(+ru), PRERELEASE (AB).

gateway/internal/backendclient/api.go

@@ -224,6 +224,25 @@ func (c *Client) Profile(ctx context.Context, userID string) (ProfileResp, error
 	return out, err
 }
 
+// BlockStatusResp is the caller's current manual-block state. Until is an RFC3339 UTC instant for
+// a temporary block, empty for a permanent one or when not blocked; Reason is resolved to the
+// account's language, empty when none was cited.
+type BlockStatusResp struct {
+	Blocked   bool   `json:"blocked"`
+	Permanent bool   `json:"permanent"`
+	Until     string `json:"until"`
+	Reason    string `json:"reason"`
+}
+
+// BlockStatus fetches the caller's current block. It is the one user endpoint a blocked account
+// can still reach (the backend's suspension gate exempts it), so the UI can render the blocked
+// screen.
+func (c *Client) BlockStatus(ctx context.Context, userID string) (BlockStatusResp, error) {
+	var out BlockStatusResp
+	err := c.do(ctx, http.MethodGet, "/api/v1/user/block-status", userID, "", nil, &out)
+	return out, err
+}
+
 // SubmitPlay commits a placement on the player's turn. The tiles are addressed by alphabet
 // index.
 func (c *Client) SubmitPlay(ctx context.Context, userID, gameID string, tiles []PlayTileJSON) (MoveResultResp, error) {