feat: cases (reports, rating reviews, removal and deletion requests, appeals) and notifications

Cases are one queue for what someone has to decide, each with a thread (internal notes for those deciding), an
assignee and a decision. Reports about a product go to the teams of the catalogs hosting it and to moderators, and
only the reporter and moderators know who reported. A creator lowering a rating opens a rating review; a catalog's
owner asking to delete it opens a deletion request; a catalog's team can ask for a product's removal everywhere; the
person an action affected can appeal it once, decided by another moderator (an admin may decide their own, flagged).
Resolving carries the case out: the rating is lowered, the product removed, the catalog deleted.

Notifications reach people on the website (a bell with the unread count) and their proxies (realtime): moderators'
edits to their products, removals and restores, decisions and replies on their cases, membership decisions.

Also: moderators can restore a removed product, and a product's creator and moderators can see it when it's adult
without an adult account (getting and wearing it still need one).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/test/products.test.ts

@@ -189,12 +189,16 @@ test("catalogs register uploads; products have revisions, info and libraries", a
   await call(maker, "POST", `/api/v1/products/${adultID}/publish`);
   expect((await call(maker, "GET", `/api/v1/products/${adultID}`)).status).toBe(200);
   expect((await call(kid, "GET", `/api/v1/products/${adultID}`)).status).toBe(404);
+  // Its creator and moderators see it without an adult account; getting or wearing it still needs one.
+  expect((await call(admin, "GET", `/api/v1/products/${adultID}`)).status).toBe(200);
+  expect((await call(admin, "PUT", `/api/v1/library/${adultID}`)).status).toBe(404);
+  expect((await call(admin, "GET", `/api/v1/products/${adultID}/files`)).status).toBe(404);
   expect((await call(kid, "PUT", `/api/v1/library/${adultID}`)).status).toBe(404);
   expect((await call(undefined, "GET", "/api/v1/products")).json.products.map((p: any) => p.name)).toEqual(["Blue Coat"]);
   expect((await call(maker, "GET", "/api/v1/products?q=lac")).json.products.map((p: any) => p.name)).toEqual(["Lace"]);
 
-  // Lowering a rating waits for review.
-  expect((await call(maker, "PATCH", `/api/v1/products/${adultID}`, { rating: "general" })).json.error).toBe("review_needed");
+  // Its files are rated adult, so it can't be lowered (a revision rated general can be reviewed: cases.test.ts).
+  expect((await call(maker, "PATCH", `/api/v1/products/${adultID}`, { rating: "general" })).json.error).toBe("files_adult");
 
   expect((await call(kid, "DELETE", `/api/v1/library/${id}`)).status).toBe(204);
   expect((await call(kid, "GET", "/api/v1/library")).json.library).toEqual([]);
@@ -404,7 +408,10 @@ test("product info: moderators edit with reasons and lock fields; history and re
 
   // Ratings: anyone with product:edit raises it; lowering is for moderators, and not below its files' rating.
   expect((await call(maker, "PATCH", `/api/v1/products/${id}`, { rating: "adult" })).status).toBe(200);
-  expect((await call(maker, "PATCH", `/api/v1/products/${id}`, { rating: "general" })).json.error).toBe("review_needed");
+  expect((await call(maker, "PATCH", `/api/v1/products/${id}`, { rating: "general" })).json).toMatchObject({
+    product: { rating: "adult" },
+    review: expect.any(Number),
+  });
   expect((await call(mod, "PATCH", `/api/v1/products/${id}`, { rating: "general", reason: "Not adult" })).status).toBe(200);
 
   // The history: every change, newest first, with who and why. Only the creator and moderators read it.