feat: file blocks

Moderators block a file network-wide by its sha256, from a product's files or the console's new Blocks tab, which
first shows the products using it. Blocking removes those products (their creators are told and may appeal), puts
a `block` change in the changes feed of every catalog hosting it, and refuses uploads with it; moderators see who
tried. Unblocking lets it in again; the products it removed stay removed until restored.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/test/catalogs.test.ts

@@ -300,7 +300,7 @@ test("the console is for everyone who controls something; its audit log shows on
   expect(ownerConsole.sections).toEqual(["overview", "catalogs", "cases", "audit"]);
   expect(ownerConsole.moderation).toBeNull();
   expect((await call(maker, "GET", "/api/v1/console")).json.sections).toEqual(["overview", "products", "cases", "audit"]);
-  expect((await call(admin, "GET", "/api/v1/console")).json.sections).toEqual(["overview", "products", "catalogs", "cases", "people", "audit", "settings"]);
+  expect((await call(admin, "GET", "/api/v1/console")).json.sections).toEqual(["overview", "products", "catalogs", "cases", "people", "blocks", "audit", "settings"]);
 
   // The owner sees their catalog's entries, not the other catalog's; the maker sees their product's.
   const ownerLog = (await call(owner, "GET", "/api/v1/console/audit")).json.entries;