feat: file blocks

Moderators block a file network-wide by its sha256, from a product's files or the console's new Blocks tab, which
first shows the products using it. Blocking removes those products (their creators are told and may appeal), puts
a `block` change in the changes feed of every catalog hosting it, and refuses uploads with it; moderators see who
tried. Unblocking lets it in again; the products it removed stay removed until restored.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/console.md

@@ -93,6 +93,8 @@ Sections (each shown only to those with something in it):
 - **Rooms**: their hosted rooms.
 - **Cases**: reports, appeals and reviews about what they control.
 - **People**: moderators and admins.
+- **Blocks**: those who remove products hub-wide (`product:remove`): blocked files, a file's page (the products using it;
+  block, unblock). Each file in a product's revisions links to its page for them.
 - **Audit**: scoped (below).
 - **Settings**: admins (registration, announcements, roles).