feat(desktop): browse and moderate every community in the Admin Console

[wpfleger96]

Stack: #8011 → this PR. This PR targets main, so until #8011 merges its diff also shows #8011's crates/ commits. Only desktop/ belongs to this PR.

The Admin Console only ever saw the community the desktop happened to be connected to. With #8011's community reads, the console can now browse every community on the relay and, for signed staff, moderate any of them by name without switching connections. 🤖

What changes

• Communities tab. Lists every live community on the relay, searchable by host prefix with "Load more" paging. The connected community is pinned at the top by exact host match. Report rows get a community badge that opens that community.
• Community page. Reports, Restrictions, Members and Actions, each scoped to the community on the page. The Actions form has no host field: it always acts on the page's community, and the TypeScript host normalization is gone from the Actions tab.
• Native reads (admin_list_communities, admin_search_members, admin_get_member, admin_get_event). Every request validates the explicit community host and NIP-98-signs the real method and URL. Failures come back as a structured error (status, bodyComplete, bodyEmpty, code), so the UI can tell an older relay's empty 404, a coded event_not_found and a transport failure apart, and never says "not found" unless the relay did.
• Explicit-host lifts. admin_lift_restriction sends the page's community host, not the active relay's. It freezes the relay and signer the intent was reviewed under, and refuses to send if either has changed.
• Pending actions survive navigation. A panel-level DirectActionsProvider holds the frozen intent, so switching communities or tabs mid-confirm doesn't lose it. Only Discard drops it. A signer change remounts the controller and drops it.
• Fenced lookups. Member and event lookups are keyed by origin, signer, community, target and a generation counter, so a late answer for one community can't unlock Review in another.
• Shared member picker (MemberSearchResult, also used by Add Member), showing the truncated npub so members with the same name can be told apart. Delete accepts a note link and previews the message before Review. Relay staff are blocked before Review.
• Disabled admin auth is read-only. With BUZZ_ADMIN_AUTH=disabled the Communities tab and community pages still render, and report badges still open them, but every ban, timeout, delete, add-member and lift control is disabled. The settings badge says the console is read-only and that acting needs nip98. Staffing stays hidden.
• feat(desktop): add Admin Console Actions tab for direct staff actions #7904's protections in the Actions tab are kept: frozen intent, requestId, Retry, notSent and the key-backup guard.
• just admin-seed for multi-community testing. Besides the local community, it seeds beta.localhost:3000, gamma.localhost:3000 and 50 filler communities, with named members, a ban and a timeout in each named community, a report with Kick available, and a message for the delete preview. Rerunning it restores all of that to the starting state. It refuses, writing nothing, while a moderation action is unfinished on a seeded report.
• The bodyless GET /events/{id} preview is added to the events-URL egress inventory. It sends no body, so it carries no key material.

Tests

Native (Rust):

• empty_404_and_405_read_as_complete_and_empty, coded_404_carries_the_relay_code, truncated_and_over_cap_bodies_are_incomplete, transport_failure_has_no_status: the structured read error tells an older relay, a coded refusal, a cut-off body and a transport failure apart.
• a_401_retry_is_signed_by_the_same_keys, lift_signs_the_send_and_401_retry_with_the_checked_keys: the 401 retry never switches keys.
• read_urls_validate_the_explicit_host_and_encode_the_query, lift_url_sends_the_page_host_not_the_active_relay, list_url_carries_host_and_cursor_and_refuses_a_changed_relay, lift_refuses_before_sending_on_signer_change_or_bad_host: requests target the explicit host and refuse to send after a relay or signer change.

jsdom:

• actions-pending-nav: a pending intent survives a community change, and only Discard drops it.
• actions-fenced-lookup, fenced-load: a late lookup for an old key never shows under, or unlocks, the new one.
• actions-same-ids: the same pubkey and event id are read separately in each community.
• actions-community-change-drops-member, actions-page-host, actions-success, actions-identity: the form acts only in the page's community, and confirm sends the frozen intent.
• actions-preview-errors, actions-delete-link, actions-staff-target, actions-disabled-auth: preview errors, delete by note link, the staff block, and community pages rendering read-only with every action control disabled under disabled admin auth.
• communities-directory, communities-unsupported, community-badge, community-badge-disabled-auth: the directory, older relays, and report badges, which open community pages under disabled admin auth too.
• restrictions-lift-signer-change. The existing restriction tests now run on the community page and use admin_lift_restriction.

Mutation checks: removing the pending-navigation guard turns actions-pending-nav red, and dropping the host from the fence key turns actions-fenced-lookup, actions-same-ids and fenced-load red. Ungating restriction lifts on canMutate turns actions-disabled-auth red.

[wpfleger96]

🤖 Captured headless from the e2e build at ebbb8dbd2. Tauri IPC is mocked in the capture script, so admin API responses, community lists, members, message previews and the native error strings are all simulated. Community hosts are placeholders (alpha.example.com, beta.example.com, ...), and the app is connected to a different community than the one being viewed in most shots, so the "not the community you're connected to" warning shows.

Reports, grouped by community

Reports from every community the relay hosts, grouped under one community heading per group. The badge sits in the heading only, not on each row.

Resolving a report from another community

The confirm names the community and warns that it isn't the one you're connected to.

Feedback, grouped by community

Same grouping as Reports.

Operators

The operator roster tab.

Communities tab

First page of the relay's community directory.

Communities tab, after "Load more"

The second page is appended below the first.

Communities search

Searching by host. The community you're connected to is pinned at the top only when its host starts with the query, so it is absent for team1 here.

A community's page: Reports

Reports for just this community. There is no group heading because the banner at the top already names the community.

A community's page: Restrictions

Active bans and timeouts in this community, each with its own lift button.

Lifting a restriction

The confirm names the member and the community the ban is lifted in.

A community's page: Members search

Searching this community's members by name.

A member selected

Picking a member offers Ban and Time out.

Actions: member lookup

Looking up a member before acting. An existing timeout shows its end as an absolute date and time.

Actions: message preview

Pasting an nevent loads the message so you can see what you're about to delete.

Actions: delete confirm

The delete confirm repeats the community, the author and the message text.

Message lookup errors

Four failure cases for the message preview: a relay without the new admin routes, a message that isn't in this community, a response the app couldn't read, and a relay it couldn't reach.

Communities tab errors

A relay without the community directory route, and a relay the app couldn't reach.