Add admin user moderation: block/unblock, reports, matches list, photo review

- User blocking (with reason) now closes the auth gap immediately — a
  blocked user's still-valid access token stops working on the next
  request, not just on their next OTP/refresh.
- Admin-created reports (moderation notes) per user, viewable in a history
  list independent of block status.
- GET /admin/users: full paginated, searchable user list with report counts.
- GET /admin/matches: all matches across the app ("friends" who mutually
  liked each other), for admin visibility.
- GET/DELETE /admin/photos: paginated feed of every uploaded photo with
  uploader info, so admins can review and remove content without going
  user-by-user.
- Per-user activity: monitoring requests can now be filtered by user_id, so
  a user's detail page can show their recent API activity.
- Batched the profile-selections query in fullProfilePayload (was 6 queries
  per view, now 1) for consistency with the earlier N+1 fixes.

internal/models/report.go

@@ -0,0 +1,17 @@
+package models
+
+import "time"
+
+// Report یک یادداشت/پرچم نظارتی که ادمین روی یک کاربر ثبت می‌کنه (مثلاً بر
+// اساس شکایتی که از کانال دیگه‌ای دریافت شده)؛ برای پیگیری سابقه‌ی نظارتی
+// یک کاربر، مستقل از بلاک‌شدن یا نشدنش.
+type Report struct {
+	ID        uint      `gorm:"primaryKey" json:"id"`
+	UserID    uint      `gorm:"not null;index" json:"user_id"`
+	Reason    string    `gorm:"type:text;not null" json:"reason"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+func (Report) TableName() string {
+	return "reports"
+}

internal/models/user.go

@@ -77,6 +77,10 @@ type User struct {
 	IsAdmin  bool      `gorm:"default:false;not null" json:"is_admin"`
 	IsActive bool      `gorm:"default:true;not null" json:"is_active"`
 
+	// -------- بلاک شدن توسط ادمین --------
+	BlockedReason *string    `json:"blocked_reason,omitempty"`
+	BlockedAt     *time.Time `json:"blocked_at,omitempty"`
+
 	// فیلدهای OTP - هش می‌شوند و هرگز در پاسخ API برنمی‌گردند
 	OTPCode   *string    `gorm:"size:128" json:"-"`
 	OTPExpiry *time.Time `json:"-"`