[codex] Block banned actors from moderation commands (BUZZ-SEC-007)

[jmecom]

What changed

Moderation commands now check the actor's durable, tenant-scoped ban state before executing any mutation. This closes the HTTP and stale-WebSocket paths that let a banned administrator reach an unban command without completing a fresh authentication challenge.

Timeouts remain distinct from bans: an authorized moderator who is timed out can still lift that timeout, while a banned actor cannot run any moderation command.

Why

Moderation commands intentionally run before the ordinary write-restriction gate so administrators can remove timeouts. The code assumed every banned actor had already been rejected by WebSocket authentication, but NIP-98 requests and already-authenticated sockets could reach the handler without that check. A banned administrator could therefore unban themselves and regain normal relay access.

Impact

Ban enforcement now applies at the moderation mutation boundary on every transport. Database failures while checking the ban state reject the command rather than allowing it through.

Testing

• cargo test -p buzz-relay banned_admin_cannot_reach_an_unban_command --lib

Addresses BUZZ-SEC-007.