Add admin user moderation: block/unblock, reports, matches list, photo review

- User blocking (with reason) now closes the auth gap immediately — a
  blocked user's still-valid access token stops working on the next
  request, not just on their next OTP/refresh.
- Admin-created reports (moderation notes) per user, viewable in a history
  list independent of block status.
- GET /admin/users: full paginated, searchable user list with report counts.
- GET /admin/matches: all matches across the app ("friends" who mutually
  liked each other), for admin visibility.
- GET/DELETE /admin/photos: paginated feed of every uploaded photo with
  uploader info, so admins can review and remove content without going
  user-by-user.
- Per-user activity: monitoring requests can now be filtered by user_id, so
  a user's detail page can show their recent API activity.
- Batched the profile-selections query in fullProfilePayload (was 6 queries
  per view, now 1) for consistency with the earlier N+1 fixes.

internal/repository/match_repository.go

@@ -63,6 +63,17 @@ func (r *MatchRepository) ListByUser(userID uint) ([]models.Match, error) {
 	return matches, err
 }
 
+// ListAllPaginated همه‌ی مچ‌های اپ رو صفحه‌بندی‌شده برمی‌گردونه (برای پنل ادمین)
+func (r *MatchRepository) ListAllPaginated(limit, offset int) ([]models.Match, int64, error) {
+	var total int64
+	if err := r.db.Model(&models.Match{}).Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+	var matches []models.Match
+	err := r.db.Order("created_at desc").Limit(limit).Offset(offset).Find(&matches).Error
+	return matches, total, err
+}
+
 // OtherUserID شناسه‌ی طرف مقابل کاربر جاری رو توی یک مچ برمی‌گردونه
 func OtherUserID(match *models.Match, currentUserID uint) uint {
 	if match.UserOneID == currentUserID {