test: cover Community Watch permission boundaries

[mashbean]

Summary

• add a frozen-user negative test for Community Watch takedown
• add an OSS reports negative test for non-admin users
• add an updateUserState negative test for non-admin users before using OSS batch freeze

Validation

• npm run build
• npm run test:utils -- --runTestsByPath build/common/utils/test/communityWatchRemoveComment.test.js

Notes

• The DB-backed type tests were attempted locally with npm run test:types:2 -- --runTestsByPath build/types/__test__/2/system.test.js build/types/__test__/2/user/user.test.js, but the local test DB connections were unavailable, so the suite failed before exercising these cases. CI should run them in the configured DB environment.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.02%. Comparing base (7424ab5) to head (13e6cf5).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #4826   +/-   ##
========================================
  Coverage    72.02%   72.02%           
========================================
  Files         1042     1042           
  Lines        20633    20633           
  Branches      4437     4437           
========================================
  Hits         14860    14860           
  Misses        5704     5704           
  Partials        69       69           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mashbean]

Release evaluation update

Staging E2E has passed for the Community Watch to OSS moderation flow.

Verified

• OSS live bundle smoke passed on oss.matters.icu with main.7bf0f07a.chunk.js
• OSS report list loads source=community_watch without the previous OSSReportsInput mismatch
• Community Watch rows appear as source community_watch and do not duplicate as direct reports
• Batch freeze was exercised in OSS on staging data
• cwseedtarget3 was frozen successfully and user detail shows status frozen
• Already frozen rows are no longer selectable
• Direct report source rows keep batch freeze disabled
• Community Watch public homepage and full records page render aggregate totals and pagination

Deferred to production smoke

• Staging-only Community Watch UUIDs linked from OSS can be missing on community-watch.matters.town because that public domain serves production records. This should be checked with a real production community_watch_action uuid after rollout, not treated as a staging blocker.

Recommendation

• Ready for review. This PR only adds permission-boundary coverage; the full staging moderation flow is accepted under the current product definition.