fix: correct audit event names, attachment deletion, redirect safety, and add account deactivation check

- Fix audit event names in CLI prune/clear commands from `cli.seo.*` to `cli.seo_meta.*`
- Refactor `_delete_attachment_file` to accept full attachment dict instead of storage_path string, using directory and stored_name fields with ATTACHMENTS_DIR
- Add `safe_next` validation for referer header in validation error redirect and media redirect
- Add `is_active` check in login router to reject deactivated accounts with "Account is deactivated" error
- Replace raw `request.headers.get("Referer")` with `redirect_back()` utility in bookmarks, polls, reactions, and votes routers
- Move `mark_conversation_read` call from `get_conversation_messages` to `messages_page` to avoid side effects during message retrieval
- Fix poll audit link to use `option.get("label")` instead of `option.get("text")`
- Add `VOTABLE` set validation in votes router to reject invalid target types with 400 response
- Strip control characters (0x00-0x20) from URLs in `_safe_url` instead of simple strip
- Add `__getattr__` fallback in services `__init__.py` for dynamic attribute access

devplacepy/routers/reactions.py

@@ -5,7 +5,7 @@ from datetime import datetime, timezone
 from fastapi import Depends, APIRouter, Request
 from fastapi.responses import RedirectResponse, JSONResponse
 from devplacepy.database import get_table, db, _now_iso
-from devplacepy.utils import generate_uid, require_user, track_action
+from devplacepy.utils import generate_uid, require_user, track_action, redirect_back
 from devplacepy.models import ReactionForm
 from devplacepy.services.audit import record as audit
 from devplacepy.dependencies import json_or_form
@@ -95,6 +95,4 @@ async def react(
 
     if request.headers.get("x-requested-with") == "fetch":
         return JSONResponse({"counts": counts, "mine": mine})
-    return RedirectResponse(
-        url=request.headers.get("Referer", "/feed"), status_code=302
-    )
+    return RedirectResponse(url=redirect_back(request), status_code=302)