Preserve roles when users block the bot

[ohld]

Summary

• keep Telegram bot block state in blocked_bot_at instead of overwriting user.type
• restore @okhlopkov / 49820636 as admin and clear blocked_bot_at
• filter broadcast audiences by blocked_bot_at and keep legacy blocked_bot exclusions
• document the domain term for bot blocking

Tests

• DATABASE_URL=postgresql+asyncpg://app:app@localhost:65432/app REDIS_URL=redis://:myStrongPassword@localhost:36379 CORS_ORIGINS='[]' CORS_HEADERS='[]' TELEGRAM_BOT_TOKEN=test TELEGRAM_ADMIN_BOT_TOKEN=test OPENROUTER_API_KEY=test python -m pytest tests/ -x -q
• python -m ruff check src tests alembic/versions/2026-05-25_restore_okhlopkov_admin.py
• python -m ruff format --check src tests alembic/versions/2026-05-25_restore_okhlopkov_admin.py

[ohld]

STAFF ENGINEER REVIEW: CHANGES REQUESTED — mark_user_blocked now preserves user.type for normal users and only writes blocked_bot_at, but src/flows/monitors/ghost_users.py still excludes blocked users only via u.type NOT IN ('blocked_bot', 'banned', 'waitlist'). A user who starts the bot, blocks it before receiving a meme, and has no reaction row will now be counted as a ghost and can trigger false WARN/ERROR alerts. Add u.blocked_bot_at IS NULL to the ghost monitor candidate filter before changing the write semantics.

Verification: /review and /codex review both found this semantic migration gap; focused /cso found no security blocker. python3 -m ruff check ... passed on touched files, and targeted tgbot pytest passed with required env (7 passed). Auto-merge was disabled/no queued merge was present.

[ohld]

Staff Engineer terminal note: PR #297 merged at 2026-05-25T08:31:59Z before this review completed and before the STAFF ENGINEER REVIEW: CHANGES REQUESTED fallback comment landed at 2026-05-25T08:41:40Z. I created CTO follow-up FFM-1409 [pr:297] address review changes for the post-merge fix.