docs: add block/mute user relations, emoji-sync CLI, and uid indexes

- Add `/block`, `/mute` endpoints with block/unblock and mute/unmute functionality in `routers/relations.py`, hiding blocked users' content everywhere except their own profile while muting only suppresses notifications
- Introduce `devplace emoji-sync` CLI command to regenerate `static/js/emoji-shortcodes.js` from the emoji library, documented in `CLAUDE.md` and wired in `cli.py`
- Create `get_blocked_uids()` database helper and apply it in `content.py` `load_detail()` to filter blocked users' posts from detail views
- Implement `_uid_index()` and `_drop_index()` helpers in `database.py` for unique uid indexes across tables, with `user_relations` added to `SOFT_DELETE_TABLES`
- Document new routes in `AGENTS.md` and `README.md`, including emoji shortcodes rendering behavior distinct from the emoji picker

tests/api/feed.py

@@ -386,3 +386,17 @@ def test_x_frame_options_header(app_server):
 def test_x_frame_options_excluded_for_ingress_proxy(app_server):
     r = requests.get(f"{BASE_URL}/p/nonexistent-instance", allow_redirects=False)
     assert "X-Frame-Options" not in r.headers
+
+
+def test_content_security_policy_header(app_server):
+    r = requests.get(f"{BASE_URL}/feed", allow_redirects=True)
+    csp = r.headers.get("Content-Security-Policy", "")
+    assert "object-src 'none'" in csp
+    assert "base-uri 'self'" in csp
+    assert "frame-ancestors 'none'" in csp
+    assert "form-action 'self'" in csp
+
+
+def test_content_security_policy_excluded_for_ingress_proxy(app_server):
+    r = requests.get(f"{BASE_URL}/p/nonexistent-instance", allow_redirects=False)
+    assert "Content-Security-Policy" not in r.headers