Add durable trust for comment authors

[iamwavecut]

Commenters who are not group members were repeatedly checked without durable author trust. This change grants per-chat trust to users and sender channels after three distinct safe new messages for 30 days; expiry requires one safe new message for renewal. Membership remains separate, and technical Telegram senders are never used to punish a channel.

The shared moderation path now supplies bounded, untrusted conversation context, preserves protected edit checks, and handles channel votes/reports with durable recovery. SQLite atomically records admission, preserves existing trust/cases/votes during migration, and removes bot-deleted context. Configuration, all 30 locales, statistics, Compose and architecture documentation are updated.

Validation: all 730 local tests passed in normal, race and shuffled runs on the current Go 1.26.8 toolchain. The final test-constant corrections also pass all 730 normal tests and the uncapped linter with explicit --no-config. CI and local lint now use identical defaults instead of inheriting unrelated parent configuration. Targeted regressions cover guests, channels, duplicates, expiry, SQLite failures, protected edits, context isolation and deletion/retry boundaries. Exact-head GitHub checks must pass before merge. Real-model accuracy and production savings are not inferred from these deterministic tests.

This feature adds no dependencies and retains the Go 1.26.8 security update already merged into master.

Migration/rollback: old effective trust receives 30 days; active probation starts at zero; reaction-only rows grant no trust. Downgrade refuses channel cases/bindings and unfinished CAPTCHA context cleanup. Production release requires verified database snapshots and exact-image checks through the existing release script.