docs: add block/mute user relations, emoji-sync CLI, and uid indexes

- Add `/block`, `/mute` endpoints with block/unblock and mute/unmute functionality in `routers/relations.py`, hiding blocked users' content everywhere except their own profile while muting only suppresses notifications
- Introduce `devplace emoji-sync` CLI command to regenerate `static/js/emoji-shortcodes.js` from the emoji library, documented in `CLAUDE.md` and wired in `cli.py`
- Create `get_blocked_uids()` database helper and apply it in `content.py` `load_detail()` to filter blocked users' posts from detail views
- Implement `_uid_index()` and `_drop_index()` helpers in `database.py` for unique uid indexes across tables, with `user_relations` added to `SOFT_DELETE_TABLES`
- Document new routes in `AGENTS.md` and `README.md`, including emoji shortcodes rendering behavior distinct from the emoji picker

tests/api/mute/index.py

@@ -0,0 +1,128 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+from uuid import uuid4
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _signup():
+    _counter[0] += 1
+    name = f"mut{int(time.time() * 1000)}{_counter[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _uid(name):
+    return get_table("users").find_one(username=name)["uid"]
+
+
+def _key(name):
+    return get_table("users").find_one(username=name)["api_key"]
+
+
+def _relation(actor_uid, target_uid, kind):
+    return get_table("user_relations").count(
+        user_uid=actor_uid, target_uid=target_uid, kind=kind, deleted_at=None
+    )
+
+
+def _new_post(session):
+    return session.post(
+        f"{BASE_URL}/posts/create",
+        headers=JSON,
+        data={
+            "title": f"mutpost{uuid4().hex[:8]}",
+            "content": "muted author still visible post",
+            "topic": "devlog",
+        },
+    ).json()["data"]
+
+
+def test_mute_creates_relation(app_server):
+    muter_session, muter = _signup()
+    _, target = _signup()
+    r = muter_session.post(f"{BASE_URL}/mute/{target}", allow_redirects=False)
+    assert r.status_code in (302, 200)
+    assert _relation(_uid(muter), _uid(target), "mute") == 1
+
+
+def test_mute_is_idempotent(app_server):
+    muter_session, muter = _signup()
+    _, target = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{target}", allow_redirects=False)
+    muter_session.post(f"{BASE_URL}/mute/{target}", allow_redirects=False)
+    assert _relation(_uid(muter), _uid(target), "mute") == 1
+
+
+def test_self_mute_rejected(app_server):
+    muter_session, muter = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{muter}", allow_redirects=False)
+    assert _relation(_uid(muter), _uid(muter), "mute") == 0
+
+
+def test_mute_recorded_in_audit(seeded_db):
+    muter_session, muter = _signup()
+    muter_session.post(
+        f"{BASE_URL}/mute/bob_test", headers=JSON, allow_redirects=False
+    )
+    admin = requests.Session()
+    admin.headers.update({"X-API-KEY": _key("alice_test")})
+    data = admin.get(
+        f"{BASE_URL}/admin/audit-log",
+        headers=JSON,
+        params={"event_key": "relation.mute"},
+    ).json()
+    assert any(
+        e.get("target_label") == "bob_test" and muter in (e.get("summary") or "")
+        for e in data["entries"]
+    )
+
+
+def test_muted_user_notifications_suppressed(app_server):
+    muter_session, muter = _signup()
+    actor_session, actor = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{actor}", allow_redirects=False)
+
+    actor_session.post(f"{BASE_URL}/follow/{muter}", allow_redirects=False)
+
+    assert (
+        get_table("notifications").count(
+            user_uid=_uid(muter), related_uid=_uid(actor), type="follow"
+        )
+        == 0
+    )
+
+
+def test_muted_user_content_still_visible(app_server):
+    muter_session, muter = _signup()
+    author_session, author = _signup()
+    post = _new_post(author_session)
+    muter_session.post(f"{BASE_URL}/mute/{author}", allow_redirects=False)
+
+    feed = muter_session.get(f"{BASE_URL}/feed", headers=JSON).json()
+    assert post["uid"] in [i["post"]["uid"] for i in feed["posts"]]
+
+
+def test_profile_json_reports_is_muted(app_server):
+    muter_session, muter = _signup()
+    _, target = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{target}", allow_redirects=False)
+
+    data = muter_session.get(f"{BASE_URL}/profile/{target}", headers=JSON).json()
+    assert data["is_muted"] is True
+    assert data["is_blocked"] is False

tests/api/mute/unmute.py

@@ -0,0 +1,65 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _signup():
+    _counter[0] += 1
+    name = f"unmut{int(time.time() * 1000)}{_counter[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _uid(name):
+    return get_table("users").find_one(username=name)["uid"]
+
+
+def _active_mutes(actor_uid, target_uid):
+    return get_table("user_relations").count(
+        user_uid=actor_uid, target_uid=target_uid, kind="mute", deleted_at=None
+    )
+
+
+def test_unmute_reverses_mute(app_server):
+    muter_session, muter = _signup()
+    _, target = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{target}", allow_redirects=False)
+    assert _active_mutes(_uid(muter), _uid(target)) == 1
+
+    r = muter_session.post(
+        f"{BASE_URL}/mute/unmute/{target}", allow_redirects=False
+    )
+    assert r.status_code in (302, 200)
+    assert _active_mutes(_uid(muter), _uid(target)) == 0
+
+
+def test_unmute_restores_notifications(app_server):
+    muter_session, muter = _signup()
+    actor_session, actor = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{actor}", allow_redirects=False)
+    muter_session.post(f"{BASE_URL}/mute/unmute/{actor}", allow_redirects=False)
+
+    actor_session.post(f"{BASE_URL}/follow/{muter}", allow_redirects=False)
+
+    assert (
+        get_table("notifications").count(
+            user_uid=_uid(muter), related_uid=_uid(actor), type="follow"
+        )
+        == 1
+    )