Add admin user moderation: block/unblock, reports, matches list, photo review

- User blocking (with reason) now closes the auth gap immediately — a
  blocked user's still-valid access token stops working on the next
  request, not just on their next OTP/refresh.
- Admin-created reports (moderation notes) per user, viewable in a history
  list independent of block status.
- GET /admin/users: full paginated, searchable user list with report counts.
- GET /admin/matches: all matches across the app ("friends" who mutually
  liked each other), for admin visibility.
- GET/DELETE /admin/photos: paginated feed of every uploaded photo with
  uploader info, so admins can review and remove content without going
  user-by-user.
- Per-user activity: monitoring requests can now be filtered by user_id, so
  a user's detail page can show their recent API activity.
- Batched the profile-selections query in fullProfilePayload (was 6 queries
  per view, now 1) for consistency with the earlier N+1 fixes.

internal/handler/monitoring_handler.go

@@ -23,7 +23,9 @@ func (h *MonitoringHandler) Summary(c *gin.Context) {
 	utils.Success(c, http.StatusOK, "", h.store.Summary())
 }
 
-// RecentRequests GET /admin/monitoring/requests?limit=100
+// RecentRequests GET /admin/monitoring/requests?limit=100&user_id=42
+// اگه user_id داده بشه، فقط فعالیت اخیر همون کاربر برمی‌گرده (برای صفحه‌ی
+// جزئیات کاربر توی پنل ادمین)؛ وگرنه آخرین درخواست‌های کل سرور.
 func (h *MonitoringHandler) RecentRequests(c *gin.Context) {
 	limit := 100
 	if raw := c.Query("limit"); raw != "" {
@@ -31,5 +33,13 @@ func (h *MonitoringHandler) RecentRequests(c *gin.Context) {
 			limit = n
 		}
 	}
+
+	if raw := c.Query("user_id"); raw != "" {
+		if uid, err := strconv.ParseUint(raw, 10, 64); err == nil {
+			utils.Success(c, http.StatusOK, "", h.store.RecentByUser(uint(uid), limit))
+			return
+		}
+	}
+
 	utils.Success(c, http.StatusOK, "", h.store.Recent(limit))
 }