feat(hub): add moderation — content blocklist + reports — 5.9

DB: ContentReport + ContentBlocklist tables.
POST /v1/reports: public endpoint, auto-blocks after 2 reports.
GET /v1/blocklist/check: node sync check before serving public content.
GET /v1/blocklist: full list for node startup sync.
GET|POST|DELETE /v1/admin/blocklist: admin management.
6/6 tests. Full suite: 59/59.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

1 files changed, 35 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py
index 3814f2e..63cc8c3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/models.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py
@@ -142,6 +142,41 @@ class RefreshToken(Base):
 
 # ── IP logs (legal compliance) ────────────────────────────────────────────────
 
+class ContentReport(Base):
+    """
+    Report of a public content hash for moderation.
+    Two reports → automatic suspension. Third → admin review needed.
+    """
+    __tablename__ = "content_reports"
+
+    id:           Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    reporter_id:  Mapped[str | None] = mapped_column(ForeignKey("users.id"))
+    content_hash: Mapped[str] = mapped_column(String(64), nullable=False)   # blake3 hex
+    group_id:     Mapped[str | None] = mapped_column(ForeignKey("groups.id"))
+    reason:       Mapped[str] = mapped_column(String(32), default="illegal")
+    detail:       Mapped[str | None] = mapped_column(String(256))
+    ip_address:   Mapped[str] = mapped_column(String(45), nullable=False)
+    reported_at:  Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
+
+    __table_args__ = (
+        Index("ix_content_reports_hash", "content_hash"),
+        Index("ix_content_reports_group", "group_id"),
+    )
+
+
+class ContentBlocklist(Base):
+    """
+    Hash-based blocklist for public content.
+    Populated automatically after threshold reports, or manually by admins.
+    """
+    __tablename__ = "content_blocklist"
+
+    content_hash: Mapped[str] = mapped_column(String(64), primary_key=True)
+    reason:       Mapped[str] = mapped_column(String(64), nullable=False)
+    added_at:     Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
+    added_by:     Mapped[str | None] = mapped_column(String(64))  # "auto" or admin username
+
+
 class IPLog(Base):
     """
     Connection log for legal compliance.