feat(blacklist): add per-topic text deny-list with whitelist exceptions

Six public commands let any member of a chat curate two lists of text and
ask whether a given text is blocked: /blacklist_add, /blacklist_del,
/whitelist_add, /whitelist_del, /blacklist_rules and /blacklist_check.

The module is passive. It never reads ordinary chat messages and never
deletes, warns or restricts anyone; the lists stay inert until
/blacklist_check asks about a specific text.

Scope is one forum topic, keyed (Chat.ID, MessageThreadID) and gated on
IsTopicMessage so a reply chain in a plain supergroup does not become its
own unreachable scope. A plain group, a DM and a forum's General topic all
resolve to one chat-wide list.

Matching is substring, after NFKC composition, case folding and whitespace
collapse. Diacritics stay significant, so ma, má and mà are three entries.
A whitelist entry rescues a blacklist match only when it spans that match,
which is what keeps "I met an assassin, dumbass" blocked.

Entry text is percent-encoded before it becomes a storage key, since keys
forbid '/' and cap at 1500 bytes, and is capped at 200 bytes before and
after normalization because NFKC can expand as well as contract.

/blacklist_rules reads each list with Scan, so listing costs one round trip
per list rather than a Get per entry.

cmd/server/command_menu_test.go

@@ -75,6 +75,12 @@ func TestCommandDiscovery_AllPublicCommandsHaveSafeMetadata(t *testing.T) {
 		"addsticker":           "[emoji...]",
 		"alias":                "<name>",
 		"aliases":              "",
+		"blacklist_add":        "[text...]",
+		"blacklist_del":        "<text...>",
+		"blacklist_rules":      "",
+		"blacklist_check":      "<text...>",
+		"whitelist_add":        "[text...]",
+		"whitelist_del":        "<text...>",
 		"unalias":              "<name>",
 		"insert":               "<name>",
 		"stats":                "[users | user <username> | cmd <command_name>]",