Add admin user moderation: block/unblock, reports, matches list, photo review

- User blocking (with reason) now closes the auth gap immediately — a
  blocked user's still-valid access token stops working on the next
  request, not just on their next OTP/refresh.
- Admin-created reports (moderation notes) per user, viewable in a history
  list independent of block status.
- GET /admin/users: full paginated, searchable user list with report counts.
- GET /admin/matches: all matches across the app ("friends" who mutually
  liked each other), for admin visibility.
- GET/DELETE /admin/photos: paginated feed of every uploaded photo with
  uploader info, so admins can review and remove content without going
  user-by-user.
- Per-user activity: monitoring requests can now be filtered by user_id, so
  a user's detail page can show their recent API activity.
- Batched the profile-selections query in fullProfilePayload (was 6 queries
  per view, now 1) for consistency with the earlier N+1 fixes.

internal/router/router.go

@@ -96,10 +96,22 @@ func Setup(
 	// -------- پنل ادمین (نیاز به ورود + نقش ادمین) --------
 	admin := api.Group("/admin", authRequired, middleware.AdminRequired())
 	{
+		admin.GET("/users", h.Admin.ListAllUsers)
 		admin.GET("/users/pending", h.Admin.ListPendingUsers)
 		admin.GET("/users/:id", h.Admin.GetUserDetail)
 		admin.POST("/users/:id/approve", h.Admin.ApproveUser)
 		admin.POST("/users/:id/reject", h.Admin.RejectUser)
+		admin.POST("/users/:id/block", h.Admin.BlockUser)
+		admin.POST("/users/:id/unblock", h.Admin.UnblockUser)
+		admin.POST("/users/:id/report", h.Admin.ReportUser)
+		admin.GET("/users/:id/reports", h.Admin.ListUserReports)
+
+		// رفقا (مچ‌ها)
+		admin.GET("/matches", h.Admin.ListAllMatches)
+
+		// نظارت بر عکس‌های آپلودشده
+		admin.GET("/photos", h.Admin.ListAllPhotos)
+		admin.DELETE("/photos/:id", h.Admin.DeletePhoto)
 
 		admin.GET("/categories/:key", h.Admin.GetCategory)
 		admin.PATCH("/categories/:key", h.Admin.UpdateCategory)