feat(user-ban): frontend ban modal replaces the backend restrictions tab

1:1 replicate the reference theme user-ban flow on the frontend:

- Ban/unban modal rendered by inc/helpers/user-ban.php, opened via
  AksrtModalRuntime.openRemote (600px desktop dialog, 360px initial
  height, mobile bottom drawer, c-yellow colorful unban header).
- Three entry points wired: user homepage cover three-dot menu,
  comment section menu, article author card menu (ban item takes
  priority over report, matching the reference hook order).
- REST endpoints /user-ban/modal and /user-ban/set under aksrt/v1,
  guarded by check_permission, persisted through User\Restriction.
- Submit semantics match zib_ajax_set_user_ban: ban reloads the page,
  unban only closes the modal.

Cleanup (no dual-track): the backend ban-restrictions tab, its form
handlers and flash keys are removed; ticket processing links to the
frontend user homepage as the reference theme does; admin/report and
appeal notification URLs move to type/status query args.

Verification: 337/337 widget-system contract tests, 41/41 admin and
front-submit tests, php -l clean on all changed PHP files.

src/Admin/UserController.php

@@ -310,6 +310,21 @@ class UserController extends ControllerBase {
             'callback'            => [$this, 'get_restriction_stats'],
             'permission_callback' => [$this, 'check_permission'],
         ]);
+
+        // 前台禁封弹窗（1:1 复刻参考主题 set_user_ban_modal / zib_get_set_user_ban_modal）。
+        // modal 内容每次拉取（restriction 状态可能已变），不缓存。
+        register_rest_route(self::API_NAMESPACE, '/user-ban/modal', [
+            'methods'             => 'GET',
+            'callback'            => [$this, 'get_user_ban_modal'],
+            'permission_callback' => [$this, 'check_permission'],
+        ]);
+
+        // 前台禁封 / 解封提交（对齐参考主题 wp_ajax_set_user_ban）。
+        register_rest_route(self::API_NAMESPACE, '/user-ban/set', [
+            'methods'             => 'POST',
+            'callback'            => [$this, 'set_user_ban'],
+            'permission_callback' => [$this, 'check_permission'],
+        ]);
     }