feat(users): enforce real bans from report processing and fix appeal lifting

- apply_report_action now writes aksrt_user_restriction via Restriction::restrict
  and lifts via new lift_user_restriction(), replacing the display-only
  aksrt_user_ban_state meta dual-track
- ban type restrictions destroy the target user's sessions on apply
- appeal approval lifts active ban/suspend/mute restrictions instead of
  updating a nonexistent status column
- UsersBan.vue posts to /users/{id}/restrict with valid types (warn/mute/
  suspend/ban), scope and expires_at
- add comment report entry to the comment actions dropdown
- add duplicate pending report guard on submit
- remove dead ReportCenter ajax handlers, option migration, REST alias
  routes and write-only restriction meta
- fix report admin mail link to the real aksrt_user_ban page
- add report-ban contract tests

uninstall.php

@@ -67,6 +67,7 @@ $meta_keys = [
     'aksrt_unread_message_count',
     '_aksrt_active_restrictions',
     '_aksrt_is_banned',
+    'aksrt_user_ban_state',
     '_aksrt_favorite_posts',
     'aksrt_wechat_openid',
     'aksrt_wechat_subscriptions',