Add community content reports, map bans, and appeals

docs/moderation.md

@@ -22,6 +22,23 @@ The query must return the intended user's ID. An empty result means the person h
 
 Treat the website role separately from Supabase organization membership: moderators do not need access to your Supabase project or its secret key. The existing test moderator account is a verification fixture; it does not grant access to your personal account.
 
+# Community reports and map ban appeals
+
+Signed-in players can use **Report content** on a published map page to report the entire map, or during a game to report the current panorama. Reports include a category, a 10–2000 character explanation, and an optional HTTP/HTTPS evidence link. The website derives panorama identity from the player's accessible game round; it retains the reported immutable revision for moderator inspection. Owners cannot report their own maps. Each person can have only one open or confirmed report per map until its ban is appealed successfully; dismissed reports can be corrected and resubmitted.
+
+In `/moderation`, inspect the reported surface map and 360° locations, then **Confirm report · add strike** or **Dismiss report**, with written feedback. Pending and dismissed reports never count toward bans. Each distinct reporter can contribute one confirmed strike. Confirming the third report atomically unpublishes the map and blocks publication. The ban applies to the map, not the owner's account. Existing games retain their original revisions; the map disappears from the public catalog and cannot start new games.
+
+The owner opens the banned map from `/dashboard` and uses **Appeal map ban**. One appeal can await review at a time. Moderators can inspect the map and approve or reject the appeal with feedback. Rejection keeps the ban and permits another appeal with new information. Approval restores the last published revision, resets the three-strike counter, closes pending reports from the old cycle, and preserves all report and appeal history. A moderator cannot confirm their own report, confirm reports on their own map, or approve their own map's appeal.
+
+Contribution uploads older than five days are hidden from the dashboard and the owner's **Player submissions** list. Nothing is deleted: direct contribution links, accepted panoramas, and quota accounting still work. The cutoff uses the contribution's creation time, including pending submissions.
+
+Apply `supabase/migrations/20261006074343_content_reports_and_appeals.sql` after all previous migrations before deploying this website. All new decision functions and the appeal table are restricted to the server service role, and appeal RLS is enabled. Run `tests/sql/moderation.sql` against a database with six test accounts (the transaction rolls back), or run the isolated local verification:
+
+```sh
+npm install --prefix .data/sql-verification --no-save --package-lock=false @electric-sql/pglite@0.3.14
+node scripts/test-moderation-sql.mjs
+```
+
 # First beta map
 
 Published-map updates now have their own review state. Owners approve player submissions first and submit the combined map update; **Approve update** publishes a new immutable revision. Returning an update with feedback keeps the previous version playable. See [panorama contributions](panorama-contributions.md).