Feat security auto-ban

[dominikletica]

Summary

[DESCRIPTION/SUMMARY]

Testing

• bin/phpunit: [RESULT]
• bin/jstest: [RESULT]
• bin/lint: [RESULT]
• Other (if not already covered by the full suites above):

Documentation

• Updated project readme (README.md)
• Updated feature drafts (dev/draft/*.md)
• Updated class map (dev/CLASSMAP.md)
• Updated worklog (dev/WORKLOG.md)
• Updated dev/user manuals (dev/manual/*.md / docs/*.md)

Additional Checks

• Security/privacy considerations, public entry points, sessions, secrets, and browser storage reviewed
• Package/module boundaries, access levels, route/API/live endpoint scopes, and collision risks reviewed
• Setup/init/CI, cross-platform behavior, disabled-feature fallbacks, and process/env handling reviewed
• Project-rules-, architecture-, naming- and documentation-drift reviewed (see P4 drift audit: architecture, modularity, naming, performance, and Symfony alignment #57 for details)
• Follow-up tasks captured in WORKLOG
• Updated / aligned translations and user-facing copy

Linked Issues / Discussions

Part of the feat-security branch tree (#102)

Review Notes