feat(users): enforce real bans from report processing and fix appeal lifting

- apply_report_action now writes aksrt_user_restriction via Restriction::restrict
  and lifts via new lift_user_restriction(), replacing the display-only
  aksrt_user_ban_state meta dual-track
- ban type restrictions destroy the target user's sessions on apply
- appeal approval lifts active ban/suspend/mute restrictions instead of
  updating a nonexistent status column
- UsersBan.vue posts to /users/{id}/restrict with valid types (warn/mute/
  suspend/ban), scope and expires_at
- add comment report entry to the comment actions dropdown
- add duplicate pending report guard on submit
- remove dead ReportCenter ajax handlers, option migration, REST alias
  routes and write-only restriction meta
- fix report admin mail link to the real aksrt_user_ban page
- add report-ban contract tests

src/Admin/UserController.php

@@ -144,11 +144,6 @@ class UserController extends ControllerBase {
         ]);
 
         // Report ticket list (admin)
-        register_rest_route(self::API_NAMESPACE, '/report/list', [
-            'methods'             => 'GET',
-            'callback'            => [$this, 'get_report_list'],
-            'permission_callback' => [$this, 'check_permission'],
-        ]);
         register_rest_route(self::API_NAMESPACE, '/users/reports', [
             'methods'             => 'GET',
             'callback'            => [$this, 'get_report_list'],
@@ -165,20 +160,6 @@ class UserController extends ControllerBase {
             'permission_callback' => [$this, 'check_permission'],
         ]);
 
-        // Report status update (admin)
-        register_rest_route(self::API_NAMESPACE, '/report/update-status', [
-            'methods'             => 'POST',
-            'callback'            => [$this, 'update_report_status'],
-            'permission_callback' => [$this, 'check_permission'],
-        ]);
-
-        // Report counts (admin)
-        register_rest_route(self::API_NAMESPACE, '/report/counts', [
-            'methods'             => 'GET',
-            'callback'            => [$this, 'get_report_counts'],
-            'permission_callback' => [$this, 'check_permission'],
-        ]);
-
         // Report submit (logged-in users, front-end)
         register_rest_route(self::API_NAMESPACE, '/report/submit', [
             'methods'             => 'POST',