feat(users): enforce real bans from report processing and fix appeal lifting

- apply_report_action now writes aksrt_user_restriction via Restriction::restrict
  and lifts via new lift_user_restriction(), replacing the display-only
  aksrt_user_ban_state meta dual-track
- ban type restrictions destroy the target user's sessions on apply
- appeal approval lifts active ban/suspend/mute restrictions instead of
  updating a nonexistent status column
- UsersBan.vue posts to /users/{id}/restrict with valid types (warn/mute/
  suspend/ban), scope and expires_at
- add comment report entry to the comment actions dropdown
- add duplicate pending report guard on submit
- remove dead ReportCenter ajax handlers, option migration, REST alias
  routes and write-only restriction meta
- fix report admin mail link to the real aksrt_user_ban page
- add report-ban contract tests

src/User/Home.php

@@ -355,8 +355,18 @@ class Home {
             return [];
         }
 
-        $state = sanitize_key((string) get_user_meta($user_id, 'aksrt_user_ban_state', true));
-        if (!in_array($state, ['muted', 'restricted', 'banned'], true)) {
+        $state = '';
+        if (class_exists('\AKSRT\User\Restriction')) {
+            $svc = \AKSRT\User\Restriction::get_instance();
+            if ($svc->is_banned($user_id)) {
+                $state = 'banned';
+            } elseif ($svc->is_restricted($user_id, \AKSRT\User\Restriction::TYPE_SUSPEND)) {
+                $state = 'restricted';
+            } elseif ($svc->is_restricted($user_id, \AKSRT\User\Restriction::TYPE_MUTE)) {
+                $state = 'muted';
+            }
+        }
+        if ($state === '') {
             return [];
         }