feat: manage blocked and muted accounts, and drop the settings entries that never worked

[karlitschek]

Blocking and muting could only be done from an account's profile, and there was no way to see what you had blocked. GET /api/v1/blocks and GET /api/v1/mutes answered correctly, but nothing in the web client ever called them — so undoing a block meant remembering who it was and finding their profile again, or reaching for a third-party client.

What it adds

Settings → Blocked and muted accounts in the app's left sidebar (the settings section at the bottom, next to "Reset local cache"), listing both sets with unblock/unmute inline, each account linking to its profile, and a separate empty state per list.

Two details worth noting:

• Unblocking dispatches the same store action the profile page uses (unblockAccount/unmuteAccount), so the relationship stays in step wherever it is displayed rather than going stale behind a second code path.
• A row disappears only after the server confirms. The store action reports its own failure and resolves undefined; the view leaves the row in place then, so the UI never claims an account was unblocked when it wasn't.

A pre-existing bug fixed along the way

The paths owned by the client-side router had no server routes, so reloading or bookmarking them was a 404 — already true of /follow_requests before this change, and it would have been true of the new page. Both now render the app shell.

Their route definitions carry a postfix, because Nextcloud keys routes by name: re-using Navigation#navigate without one silently drops every declaration but the last. I hit exactly that — the first attempt left /blocked working and /follow_requests still 404ing, which is also how the duplicate would have clobbered /.

Also: the two settings entries that never worked are gone

• "Reset local cache" posted to apps/social/api/v1/cache/refresh — a route that does not exist and never has. The request 404s, nothing catches the rejection, so the button reported nothing and did nothing. git log -S dates the call to the v0.9.3 design refresh, added without a backend to talk to. (What it was meant to do already exists as occ social:cache:refresh; wiring the button up is a separate question, so this just removes the pretence.)
• "Help & documentation" linked to https://github.com/SchBenedikt/social/, a personal fork rather than any documentation of this app.

Their handler in App.vue, the reset-cache event, and the now-unused icon imports go with them, and the tests that pinned both entries are replaced by one asserting they are absent. The settings section is left with the single entry that does something.

Tests

10 view specs (both lists fetched from the endpoints, display-name fallback, profile links, per-list empty states, unblock and unmute dispatching through the store and clearing the row, a refusal keeping the row and re-enabling the button, a load failure reported without a stuck spinner, a non-list answer surviving), plus the settings entry in the navigation spec and the new route in the router spec. Suites: 1839 PHP, 626 vitest, php-cs/eslint/stylelint clean.

Verified on devel

block + mute a remote account   → blocking: true, muting: true
GET /api/v1/blocks              → [(259, spammer@spam.example, "spammer")]
GET /api/v1/mutes               → [(259, spammer@spam.example)]
unblock + unmute (string id, exactly as the view sends it) → false, false; both lists empty
/apps/social/ , /timeline/home , /follow_requests , /blocked → all 401 (page exists), none 404

🤖 Generated with Claude Code