feat: photo upload at level 3 + report a player (nudity avatar / chat insult)

Photo upload:
- Lower the custom profile-photo gate from level 25 to level 3 (client const +
  i18n hint + server gate in ProfileService.Update). The level-25 "Expert" title
  is unrelated and unchanged.

Report a player:
- New ReportReason type + service.reportUser(targetId, reason, details?).
- Report entry points: a "گزارش تخلف" button + reason picker (nudity / insult /
  other) in the public-profile modal, and a flag button in the chat header
  (reports the peer for an insulting chat) with a confirmation toast.
- Mock records reports to localStorage; SignalR POSTs /api/report.
- Server: POST /api/report → ProfileService.ReportUser stores the report in the
  write-only ledger (kind="report", ref="{targetId}|{reason}|{details}") so no
  schema change is needed (server uses EnsureCreated, not migrations).
- i18n: report.* keys (fa + en).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/lib/online/mock-service.ts

@@ -47,6 +47,7 @@ import {
   PublicProfile,
   SocialLinks,
   SocialVisibility,
+  ReportReason,
   RewardResult,
   Room,
   RoomSeat,
@@ -589,6 +590,20 @@ export class MockOnlineService implements OnlineService {
     return () => this.friendCbs.delete(cb);
   }
 
+  async reportUser(targetId: string, reason: ReportReason, details?: string) {
+    // Dev mock: just record it locally for moderation; the real backend persists.
+    try {
+      const key = "hokm.reports";
+      const raw = typeof window !== "undefined" ? localStorage.getItem(key) : null;
+      const list: unknown[] = raw ? JSON.parse(raw) : [];
+      list.push({ targetId, reason, details: details ?? "", at: this.profile?.id ?? "me" });
+      if (typeof window !== "undefined") localStorage.setItem(key, JSON.stringify(list));
+    } catch {
+      /* ignore */
+    }
+    return { ok: true };
+  }
+
   /* ------------------------------- chat ------------------------------ */
 
   private saveChats() {