Fix: exclude blocked users from ghost monitor

[ohld]

Fixes FFM-1409.

What

• Adds u.blocked_bot_at IS NULL to the ghost-user monitor candidate filter.
• Updates the monitor definition comment so current bot blockers are explicitly excluded.

Why

PR #297 preserved normal user roles when users block the bot, moving current block state to blocked_bot_at. The ghost monitor still only excluded legacy type = blocked_bot, so new users who blocked the bot before receiving a meme could produce false WARN/ERROR alerts.

Verification

• ruff check --fix src/ tests/
• ruff format src/ tests/
• DATABASE_URL=postgresql+asyncpg://user:pass@localhost:5432/db REDIS_URL=redis://localhost:6379/0 CORS_ORIGINS=["*"] CORS_HEADERS=["*"] TELEGRAM_BOT_TOKEN=123456:ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh python3 -c "from src.flows.monitors.ghost_users import _ghost_count_sql; sql = _ghost_count_sql(); assert 'u.blocked_bot_at IS NULL' in sql; assert \"u.type NOT IN ('blocked_bot', 'banned', 'waitlist')\" in sql; print('ghost SQL excludes blocked_bot_at users')"

[ohld]

STAFF ENGINEER REVIEW: APPROVED — Structural diff review, Codex review, targeted CSO pass, and narrow SQL verification are clean. No new SQL interpolation, recommendation-weight change, or secret exposure found. Ready to queue squash auto-merge if required checks are not red.

[ohld]

✅ Approved + merged.