Add admin user moderation: block/unblock, reports, matches list, photo review

- User blocking (with reason) now closes the auth gap immediately — a
  blocked user's still-valid access token stops working on the next
  request, not just on their next OTP/refresh.
- Admin-created reports (moderation notes) per user, viewable in a history
  list independent of block status.
- GET /admin/users: full paginated, searchable user list with report counts.
- GET /admin/matches: all matches across the app ("friends" who mutually
  liked each other), for admin visibility.
- GET/DELETE /admin/photos: paginated feed of every uploaded photo with
  uploader info, so admins can review and remove content without going
  user-by-user.
- Per-user activity: monitoring requests can now be filtered by user_id, so
  a user's detail page can show their recent API activity.
- Batched the profile-selections query in fullProfilePayload (was 6 queries
  per view, now 1) for consistency with the earlier N+1 fixes.

internal/middleware/auth_middleware.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
+	"dating-app/internal/models"
 	"dating-app/internal/repository"
 	"dating-app/internal/utils"
 )
@@ -44,6 +45,13 @@ func AuthRequired(jwtManager *utils.JWTManager, userRepo *repository.UserReposit
 			c.Abort()
 			return
 		}
+		// اگه کاربر بعد از صادر شدن access token فعلی بلاک شده باشه، نباید تا
+		// انقضای طبیعی همون توکن بتونه درخواست بزنه؛ این چک همون لحظه قطعش می‌کنه.
+		if user.State == models.UserStateBlocked {
+			utils.Fail(c, http.StatusForbidden, "حساب کاربری مسدود شده است", nil)
+			c.Abort()
+			return
+		}
 
 		c.Set(ContextUserKey, user)
 		c.Next()