feat: cases (reports, rating reviews, removal and deletion requests, appeals) and notifications

Cases are one queue for what someone has to decide, each with a thread (internal notes for those deciding), an
assignee and a decision. Reports about a product go to the teams of the catalogs hosting it and to moderators, and
only the reporter and moderators know who reported. A creator lowering a rating opens a rating review; a catalog's
owner asking to delete it opens a deletion request; a catalog's team can ask for a product's removal everywhere; the
person an action affected can appeal it once, decided by another moderator (an admin may decide their own, flagged).
Resolving carries the case out: the rating is lowered, the product removed, the catalog deleted.

Notifications reach people on the website (a bell with the unread count) and their proxies (realtime): moderators'
edits to their products, removals and restores, decisions and replies on their cases, membership decisions.

Also: moderators can restore a removed product, and a product's creator and moderators can see it when it's adult
without an adult account (getting and wearing it still need one).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/test/catalogs.test.ts

@@ -297,10 +297,10 @@ test("the console is for everyone who controls something; its audit log shows on
   expect((await call(nobody, "GET", "/api/v1/console")).status).toBe(403);
   expect((await call(nobody, "GET", "/api/v1/console/audit")).status).toBe(403);
   const ownerConsole = (await call(owner, "GET", "/api/v1/console")).json;
-  expect(ownerConsole.sections).toEqual(["overview", "catalogs", "audit"]);
+  expect(ownerConsole.sections).toEqual(["overview", "catalogs", "cases", "audit"]);
   expect(ownerConsole.moderation).toBeNull();
-  expect((await call(maker, "GET", "/api/v1/console")).json.sections).toEqual(["overview", "products", "audit"]);
-  expect((await call(admin, "GET", "/api/v1/console")).json.sections).toEqual(["overview", "products", "catalogs", "people", "audit", "settings"]);
+  expect((await call(maker, "GET", "/api/v1/console")).json.sections).toEqual(["overview", "products", "cases", "audit"]);
+  expect((await call(admin, "GET", "/api/v1/console")).json.sections).toEqual(["overview", "products", "catalogs", "cases", "people", "audit", "settings"]);
 
   // The owner sees their catalog's entries, not the other catalog's; the maker sees their product's.
   const ownerLog = (await call(owner, "GET", "/api/v1/console/audit")).json.entries;