feat(privacy): user blocklist with private chat enforcement

- add blocked_users table and migration
- add users API: block, unblock, list blocked users
- prevent private chat creation and private messaging when block relation exists
- add block/unblock action in private chat info panel

alembic/versions/0010_blocked_users.py

@@ -0,0 +1,46 @@
+"""add blocked users table
+
+Revision ID: 0010_blocked_users
+Revises: 0009_chat_notification_settings
+Create Date: 2026-03-08 14:25:00.000000
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "0010_blocked_users"
+down_revision: Union[str, Sequence[str], None] = "0009_chat_notification_settings"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "blocked_users",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=False),
+        sa.Column("blocked_user_id", sa.Integer(), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.ForeignKeyConstraint(["user_id"], ["users.id"], name=op.f("fk_blocked_users_user_id_users"), ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(
+            ["blocked_user_id"],
+            ["users.id"],
+            name=op.f("fk_blocked_users_blocked_user_id_users"),
+            ondelete="CASCADE",
+        ),
+        sa.PrimaryKeyConstraint("id", name=op.f("pk_blocked_users")),
+        sa.UniqueConstraint("user_id", "blocked_user_id", name="uq_blocked_users_user_target"),
+    )
+    op.create_index(op.f("ix_blocked_users_id"), "blocked_users", ["id"], unique=False)
+    op.create_index(op.f("ix_blocked_users_user_id"), "blocked_users", ["user_id"], unique=False)
+    op.create_index(op.f("ix_blocked_users_blocked_user_id"), "blocked_users", ["blocked_user_id"], unique=False)
+
+
+def downgrade() -> None:
+    op.drop_index(op.f("ix_blocked_users_blocked_user_id"), table_name="blocked_users")
+    op.drop_index(op.f("ix_blocked_users_user_id"), table_name="blocked_users")
+    op.drop_index(op.f("ix_blocked_users_id"), table_name="blocked_users")
+    op.drop_table("blocked_users")