Add admin user moderation: block/unblock, reports, matches list, photo review

- User blocking (with reason) now closes the auth gap immediately — a
  blocked user's still-valid access token stops working on the next
  request, not just on their next OTP/refresh.
- Admin-created reports (moderation notes) per user, viewable in a history
  list independent of block status.
- GET /admin/users: full paginated, searchable user list with report counts.
- GET /admin/matches: all matches across the app ("friends" who mutually
  liked each other), for admin visibility.
- GET/DELETE /admin/photos: paginated feed of every uploaded photo with
  uploader info, so admins can review and remove content without going
  user-by-user.
- Per-user activity: monitoring requests can now be filtered by user_id, so
  a user's detail page can show their recent API activity.
- Batched the profile-selections query in fullProfilePayload (was 6 queries
  per view, now 1) for consistency with the earlier N+1 fixes.

internal/monitoring/store.go

@@ -91,6 +91,29 @@ func (s *Store) Recent(n int) []RequestRecord {
 	return out
 }
 
+// RecentByUser مثل Recent ولی فقط درخواست‌های یک کاربر مشخص رو برمی‌گردونه
+// (برای دیدن فعالیت اخیر یک کاربر خاص از صفحه‌ی جزئیاتش توی پنل ادمین).
+// کل بافر رو می‌گرده (نه فقط آخرین n)، چون فیلتر شده و ممکنه درخواست‌های آن
+// کاربر پراکنده باشن.
+func (s *Store) RecentByUser(userID uint, n int) []RequestRecord {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	out := make([]RequestRecord, 0, n)
+	idx := s.next - 1
+	for i := 0; i < s.count && len(out) < n; i++ {
+		if idx < 0 {
+			idx = bufferSize - 1
+		}
+		rec := s.buf[idx]
+		if rec.UserID != nil && *rec.UserID == userID {
+			out = append(out, rec)
+		}
+		idx--
+	}
+	return out
+}
+
 func (s *Store) Summary() Summary {
 	s.mu.RLock()
 	defer s.mu.RUnlock()

internal/monitoring/store_test.go

@@ -72,3 +72,22 @@ func TestStore_RingBufferWraparound(t *testing.T) {
 		t.Fatalf("expected Recent to be capped at bufferSize (%d), got %d", bufferSize, len(recent))
 	}
 }
+
+func TestStore_RecentByUser(t *testing.T) {
+	s := NewStore()
+	uidA := uint(1)
+	uidB := uint(2)
+
+	s.Record(RequestRecord{Time: time.Now(), Path: "/a1", UserID: &uidA})
+	s.Record(RequestRecord{Time: time.Now(), Path: "/b1", UserID: &uidB})
+	s.Record(RequestRecord{Time: time.Now(), Path: "/a2", UserID: &uidA})
+	s.Record(RequestRecord{Time: time.Now(), Path: "/none"}) // بدون کاربر (مثل OTP)
+
+	got := s.RecentByUser(uidA, 10)
+	if len(got) != 2 {
+		t.Fatalf("expected 2 records for user A, got %d", len(got))
+	}
+	if got[0].Path != "/a2" || got[1].Path != "/a1" {
+		t.Fatalf("expected newest-first order for user A, got %+v", got)
+	}
+}