feat(users): enforce real bans from report processing and fix appeal lifting

- apply_report_action now writes aksrt_user_restriction via Restriction::restrict
  and lifts via new lift_user_restriction(), replacing the display-only
  aksrt_user_ban_state meta dual-track
- ban type restrictions destroy the target user's sessions on apply
- appeal approval lifts active ban/suspend/mute restrictions instead of
  updating a nonexistent status column
- UsersBan.vue posts to /users/{id}/restrict with valid types (warn/mute/
  suspend/ban), scope and expires_at
- add comment report entry to the comment actions dropdown
- add duplicate pending report guard on submit
- remove dead ReportCenter ajax handlers, option migration, REST alias
  routes and write-only restriction meta
- fix report admin mail link to the real aksrt_user_ban page
- add report-ban contract tests

src/Admin/Native/UsersMenus.php

@@ -573,21 +573,7 @@ class UsersMenus {
         update_user_meta($user_id, \AKSRT\User\BanAppeal::META_HISTORY, array_slice($history, -30));
 
         if ($decision === 'approve' && class_exists('\AKSRT\User\Restriction')) {
-            global $wpdb;
-            $table = class_exists('\AKSRT\Core\DBMigrator') ? \AKSRT\Core\DBMigrator::table('user_restriction') : '';
-            if ($table !== '') {
-                $wpdb->query($wpdb->prepare(
-                    "UPDATE {$table} SET status = 'lifted', expires_at = %s WHERE user_id = %d AND type IN ('ban','suspend','mute')",
-                    current_time('mysql'),
-                    $user_id
-                ));
-            }
-            $svc = \AKSRT\User\Restriction::get_instance();
-            if (method_exists($svc, 'clear_user_bans')) {
-                $svc->clear_user_bans($user_id);
-            } elseif (method_exists($svc, 'lift_ban')) {
-                $svc->lift_ban($user_id);
-            }
+            \AKSRT\User\Restriction::get_instance()->lift_user_restriction($user_id);
         }
 
         if (class_exists('\AKSRT\Messages\Message')) {