feat(privacy): user blocklist with private chat enforcement

- add blocked_users table and migration
- add users API: block, unblock, list blocked users
- prevent private chat creation and private messaging when block relation exists
- add block/unblock action in private chat info panel

app/users/repository.py

@@ -1,9 +1,9 @@
 from datetime import datetime, timezone
 
-from sqlalchemy import func, select
+from sqlalchemy import and_, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.users.models import User
+from app.users.models import BlockedUser, User
 
 
 async def create_user(db: AsyncSession, *, email: str, name: str, username: str, password_hash: str) -> User:
@@ -58,3 +58,52 @@ async def update_user_last_seen_now(db: AsyncSession, *, user_id: int) -> User |
     user.last_seen_at = datetime.now(timezone.utc)
     await db.flush()
     return user
+
+
+async def block_user(db: AsyncSession, *, user_id: int, blocked_user_id: int) -> BlockedUser:
+    existing = await get_block_relation(db, user_id=user_id, blocked_user_id=blocked_user_id)
+    if existing:
+        return existing
+    relation = BlockedUser(user_id=user_id, blocked_user_id=blocked_user_id)
+    db.add(relation)
+    await db.flush()
+    return relation
+
+
+async def unblock_user(db: AsyncSession, *, user_id: int, blocked_user_id: int) -> None:
+    relation = await get_block_relation(db, user_id=user_id, blocked_user_id=blocked_user_id)
+    if relation:
+        await db.delete(relation)
+
+
+async def get_block_relation(db: AsyncSession, *, user_id: int, blocked_user_id: int) -> BlockedUser | None:
+    result = await db.execute(
+        select(BlockedUser).where(
+            BlockedUser.user_id == user_id,
+            BlockedUser.blocked_user_id == blocked_user_id,
+        )
+    )
+    return result.scalar_one_or_none()
+
+
+async def has_block_relation_between_users(db: AsyncSession, *, user_a_id: int, user_b_id: int) -> bool:
+    result = await db.execute(
+        select(BlockedUser.id).where(
+            or_(
+                and_(BlockedUser.user_id == user_a_id, BlockedUser.blocked_user_id == user_b_id),
+                and_(BlockedUser.user_id == user_b_id, BlockedUser.blocked_user_id == user_a_id),
+            )
+        ).limit(1)
+    )
+    return result.scalar_one_or_none() is not None
+
+
+async def list_blocked_users(db: AsyncSession, *, user_id: int) -> list[User]:
+    stmt = (
+        select(User)
+        .join(BlockedUser, BlockedUser.blocked_user_id == User.id)
+        .where(BlockedUser.user_id == user_id)
+        .order_by(User.username.asc())
+    )
+    result = await db.execute(stmt)
+    return list(result.scalars().all())