feat: photo upload at level 3 + report a player (nudity avatar / chat insult)

Photo upload:
- Lower the custom profile-photo gate from level 25 to level 3 (client const +
  i18n hint + server gate in ProfileService.Update). The level-25 "Expert" title
  is unrelated and unchanged.

Report a player:
- New ReportReason type + service.reportUser(targetId, reason, details?).
- Report entry points: a "گزارش تخلف" button + reason picker (nudity / insult /
  other) in the public-profile modal, and a flag button in the chat header
  (reports the peer for an insulting chat) with a confirmation toast.
- Mock records reports to localStorage; SignalR POSTs /api/report.
- Server: POST /api/report → ProfileService.ReportUser stores the report in the
  write-only ledger (kind="report", ref="{targetId}|{reason}|{details}") so no
  schema change is needed (server uses EnsureCreated, not migrations).
- i18n: report.* keys (fa + en).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/lib/online/signalr-service.ts

@@ -22,6 +22,7 @@ import {
   LeaderboardEntry,
   PlayerSummary,
   PublicProfile,
+  ReportReason,
   MatchSummary,
   MatchmakingState,
   RewardResult,
@@ -377,6 +378,10 @@ export class SignalrService implements OnlineService {
   async acceptRequest(id: string) { await this.send<unknown>("POST", "/api/friends/accept", { id }); }
   async declineRequest(id: string) { await this.send<unknown>("POST", "/api/friends/decline", { id }); }
   async removeFriend(id: string) { await this.send<unknown>("POST", "/api/friends/remove", { id }); }
+  async reportUser(targetId: string, reason: ReportReason, details?: string) {
+    await this.send<unknown>("POST", "/api/report", { targetId, reason, details });
+    return { ok: true };
+  }
   onFriends(cb: (f: Friend[]) => void) { this.friendCbs.add(cb); return () => this.friendCbs.delete(cb); }
 
   createRoom(o: CreateRoomOptions) { return this.mock.createRoom(o); }