feat(api): user map proposal and moderation flow (#25)

[Aduersarius]

Closes #25.

Summary

• Durable proposal/moderation state machine on user_maps: draft → proposed → in_review → published|rejected (plus unpublish/report re-queue).
• Automated pre-checks before human review: prohibited text, blocked spawn, BFS reachability from entry, isolated walkable regions, and quota counters.
• Moderator queue + preview API (map metadata, author-uploaded graphics, reports/events) without entering the game world.
• Mandatory rejection reason returned to the author; community reports return published maps to the queue at threshold 3.
• map_moderators roster (game-data admin also allowed) so moderation is not a single-person bottleneck.
• Unit + integration tests for pre-checks and the full status flow.

Differentiation vs #59

• feat(api): user map proposal, automated pre-checks and moderation flow (#25) #59 is an in-memory pure-function stub (api/src/services/map-moderation.ts) bundled with unrelated FE/protocol/converter kitchen-sink changes; spawn check only, no Postgres queue/reports/roster, no HTTP preview API.
• This PR is scoped to api/: real schema (user_maps moderation columns, user_map_reports, user_map_review_events, map_moderators), repository + routes, BFS isolation checks the issue asks for, and tests. No frontend/protocol/converter noise.

Verification

• Tests: api/src/tests/map-moderation.unit.test.ts, api/src/tests/map-moderation.integration.test.ts (integration no-ops without DB).
• Local install/tsc blocked in agent session; CI should cover compile/test.
• No txs/keys/funds involved.

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar