fix: address the 15 CodeRabbit findings from the wire-audit review

Security:
- roomcode PUT now requires instance ownership (any player could plant
  or relocate codes on foreign private instances)
- /platformid/{accountId} requires auth (anonymous Steam/Oculus id
  enumeration oracle)
- request tracing no longer captures successful /thread bodies by
  default (chat messages landed unredacted in logs); opt in via
  Trace__SuccessBodyPaths
- anonymous action-link renewal clamped to 720h per consume

Data integrity:
- buyPurchaseReminder upserts its objective sentinel (second purchase
  threw UNIQUE after the wallet was debited)
- progression reward gift + idempotency sentinel commit in one
  transaction (crash between them double-minted the reward)
- ClubPermissionsGalleryAndModeration migration defaults corrected to
  the entity contract (CommentsJson '[]', ClubChatEnabled true); new
  one-shot ClubChatDefaultRepair migration fixes databases that
  applied the wrong defaults; bootstrap repairs '' CommentsJson rows
- admin subroom-maxplayers audit entry commits with the mutation
- account purge covers CustomAvatarItems (ownership deleted, created
  items reassigned to the system account)
- duplicate photo reports ignored while one is unresolved

Stability:
- bootstrap only swallows the expected duplicate-column error; locked
  databases and schema failures now fail startup instead of the first
  endpoint
- clone blob write failure degrades to an empty sub-room instead of a
  500 after the clone row committed
- resumed photo-feed cursor stamped DateTimeKind.Utc (Npgsql rejects
  Unspecified for timestamptz)
- unreadcounts queries per requested room instead of materialising the
  whole comment keyspace

Tests:
- destroys-the-probe-session template guard is case-insensitive

74/74 tests pass.

DorkNet.Server/Controllers/API/Images/ImagesController.cs

@@ -584,6 +584,20 @@ public class ImagesController(
         // ReportEntity has no TargetPhotoId column, so the photo id + blob name
         // ride in the message text the same way club reports carry "[club {id}]"
         // — a moderator needs the actual image to act on the report.
+        //
+        // One open report per (reporter, photo): the call is fire-and-forget
+        // and the client can't tell 200 from 404, so retries and re-opens are
+        // likely — same guard as the custom-avatar-item report path.
+        var marker = $"[photo {photo.Id} ";
+        var duplicate = await db.Reports.AnyAsync(r =>
+            r.ReporterPlayerId == reporter && r.ResolvedAt == null && r.Message.StartsWith(marker));
+        if (duplicate)
+        {
+            logger.LogInformation(
+                "[images] duplicate report of photo {PhotoId} by {Reporter} ignored", photo.Id, reporter);
+            return Ok(new RecNetResult { Success = true, Error = string.Empty });
+        }
+
         var message = $"[photo {photo.Id} {photo.BlobName}] reported from the in-game photo viewer";
         db.Reports.Add(new ReportEntity
         {