Build friendship lifecycle backend foundation

[coder13]

Summary

• canonical MongoDB relationship state and directional blocks, with authenticated lifecycle REST actions
• public identity projection only: this feature never accepts, searches, returns, logs, or measures email
• revisioned MongoDB tombstones and strictly newer PostgreSQL mirrors prevent delayed writes from resurrecting friendships or blocks
• opaque Redis/Socket.IO invalidations, with REST reconciliation as the durable client contract
• disabled-by-default HTTP and realtime surface behind SOCIAL_FEATURES_ENABLED

Request-creation limits

This replaces the former pending-request quota/reservation design. Redis atomically limits new requests to 30 per actor per 10 minutes and 3 per normalized pair per 24 hours. A Lua script checks both counters before incrementing either and assigns fixed TTLs, so it works across API processes and crashes leave no durable reservation or cleanup work. Redis failure is fail-closed (503 request_rate_limit_unavailable); a reached limit is 429 request_rate_limited with a retry time. Existing cancel/decline pair cooldowns remain.

Review hardening

• block/unblock remains fail-closed: relationship cleanup completes before block deactivation
• request creation is bounded by the atomic Redis limiter rather than an exact pending-count cap that could leak after a crash
• MongoDB tombstones plus strictly newer PostgreSQL mirrors prevent reordered writes from restoring relationships or blocks
• durable relationship/block transitions immediately mirror and invalidate; no quota reconciliation can suppress their side effects

Dependencies and remaining work

Merge order is #192 / #191 → #185 → this PR; rebase before it is ready. This remains backend foundation only: client invalidation/reconnect reconciliation belongs to #186 and room invitations to #187.

Validation

• yarn lint
• yarn test (server: 21 suites / 121 tests; client: 14 suites / 82 tests; scrambles: 1 suite / 22 tests)
• git diff --check
• focused tests cover concurrent cross-pair user limits, pair-window expiry, Redis failure, and fail-closed service behavior

A fresh-database prisma migrate deploy was not run locally because the available Lets Cube PostgreSQL container belongs to another active worktree; CI exercises the committed migration against isolated PostgreSQL 17.