feat(relay): add moderator relay-member role with full capability grid

[wpfleger96]

Summary

Adds a tenant-scoped moderator role to relay_members that holds ViewQueue, ResolveReport, DeleteMessage, Kick, Timeout, and Untimeout capabilities community-wide. Ban/Unban remain admin+ only. Guard rails prevent a moderator from Kicking or Timing-out the community owner or a fellow admin.

This is Track 2 from the relay-admin-auth plan (plan v3.2, Thufir FINAL APPROVE pass 3/3). Track 1 (desktop admin surface) is in a separate PR by Hayt.

Backend / Relay

Migration: migrations/0028_relay_moderator_role.sql — additive, drops and recreates the relay_members.role CHECK constraint to include 'moderator'. 0001 and 0027 checksums unchanged. Migration count assertion advances to 28.

Policy seam (moderation_authz.rs): ModerationAuthority::CommunityModerator added; decide_authority gains the full moderator grid with exhaustive unit tests (13 total).

Kind 9005 (moderator delete): Validator keeps author + channel-owner/admin paths byte-for-byte; gains an additive relay-role path through authorize_moderation_action(DeleteMessage) with target-role guard. Kind 5 stays author/agent-owner only.

Kind 9001 (moderator kick): Additive authorize_moderation_action(Kick) path in the validator; handle_remove_user routes to new remove_member_as_community_moderator() when actor has no channel role. Db::remove_member() is byte-for-byte unchanged. The shared post-mutation path (cache invalidation, subscription eviction, workflow disable, system message, discovery, notification) fires regardless of path.

Kind 9044 (resolve): Builds one ResolvedReportAction {required_capability, target_author, channel_id} from the stored report + get_event_by_id_including_deleted() before authorization. Normalization matrix enforced: delete/kick require event target + channel; ban/timeout require pubkey or resolvable effective author, blob rejected; dismiss/escalate decision-only. Capability map: delete→DeleteMessage, kick→Kick, ban→Ban, timeout→Timeout, dismiss/escalate→ResolveReport. A moderator's 9044 with action=ban is rejected at the seam.

Relay admin (9030/9031/9032): role=moderator grantable by admin/owner via 9030; owner-only 9032 accepts it; 9031 admin removal uses atomic role = ANY(ARRAY['member','moderator']) predicate — no TOCTOU race, NotFound/RoleMismatch/IsOwner semantics preserved.

Role-surface sweep: relay main.rs metrics role set, buzz-admin CLI validation, deploy/compose/run.sh docs all updated.

Audit: persisted-role criterion dropped per plan. actor_pubkey remains the persisted attribution. Authorization attempts logged at attempt time; success-with-authority logged only after mutation commits.

Desktop

moderationCapabilities(role): Single source of truth helper in features/moderation/lib/capabilities.ts consumed by both MessageModerationMenuItems and ModerationQueueCard. Moderators get delete/kick/timeout/untimeout/viewQueue/resolve — never ban/unban.

MessageModerationMenuItems: Capability-aware per action; Ban/Unban entries hidden for moderators.

ModerationQueueCard: Uses moderationCapabilities; passes canBan into resolvableActions; uses moderatorDeleteMessage (kind 9005) for queue delete action. Queue timeout excluded (duration-picker follow-up, unchanged from before).

TimelineMessageRow: Moderator delete affordance via 9005 path when caps.canDelete && !isOwnMessage.

CommunityMembersSettingsCard: Moderator role shown with ShieldHalf icon; role management extended to moderator tier.

Role propagation: relayMembers.ts, types.ts, e2eBridge.ts — all role unions include 'moderator'; downgrade-to-member normalization updated to preserve moderator.

events.rs: VALID_RELAY_ROLES includes 'moderator'.

New Tauri command: commands/moderator.rs — moderator_delete_message builds kind 9005 inline; extracted to new file to keep messages.rs within the file-size ratchet ceiling.

Tests Added

• 13 unit tests for decide_authority (moderator grid, guard rails, channel-role interaction)
• 9 unit tests for moderationCapabilities() exhaustive cases
• 5 unit tests for resolvableActions(canBan=false)
• 3 DB integration tests for remove_member_as_community_moderator (ordinary kick succeeds, last-owner guard fires, non-member returns MemberNotFound) — #[ignore = "requires Postgres"]
• 1 DB integration test for admin remove member/moderator matrix — #[ignore = "requires Postgres"]

Verification Priorities (Thufir)

1. 9001 sole call site: remove_member_as_community_moderator() has exactly one call site at side_effects.rs:1478.
2. Tenant fence: actor and target roles both fetched under tenant.community() in authorize_moderation_action.
3. 0028 constraint name: DROP CONSTRAINT IF EXISTS relay_members_role_check — uses the generated name; IF EXISTS for idempotency.
4. Tombstoned resolve: build_resolved_action uses get_event_by_id_including_deleted() so delete→9005→9044 succeeds after tombstoning.