[Server/Client/Protocol] Address PR #7091 review: security, bug, and perf fixes

Security:
- Promote RESET_USER_PASSWORD to admin-only dispatch (was moderator-accessible)
- Reject password reset on users with equal/higher privilege than caller
- Notify affected user via Event_NotifyUser::CUSTOM when password is reset
- Add server-side category whitelist for reports
- Drop reporter name fallback in comment/details authorization (ID-only)
- Force password change: new DB column + login enforcement + client disconnect

Bugs:
- XSS via QTextEdit::append() → insertPlainText() in report tab and utils
- allNotified initialized to true even with empty recipients list
- Warning combo box: use currentData() instead of baked-in display text
- Report resolution now records who resolved (resolved_by column + audit)

Performance:
- IP-correlation subquery: add 6-month window + LIMIT 200
- getUserSessions: clamp limit to 500

Non-blocking:
- Palette-aware colors in report_utils.cpp (dark/light mode)
- Report list pagination: offset/limit fields + total_count in response
- SessionCommand enum gap comment for reserved values 1201-1203

Schema: 36→37 (force_password_change), 37→38 (resolved_by)

Took 12 minutes


Took 16 seconds

libcockatrice_protocol/libcockatrice/protocol/pb/admin_commands.proto

@@ -5,6 +5,7 @@ message AdminCommand {
         SHUTDOWN_SERVER = 1001;
         RELOAD_CONFIG = 1002;
         ADJUST_MOD = 1003;
+        RESET_USER_PASSWORD = 1016;
     }
     extensions 100 to max;
 }
@@ -37,3 +38,10 @@ message Command_AdjustMod {
     optional bool should_be_mod = 2;
     optional bool should_be_judge = 3;
 }
+
+message Command_ResetUserPassword {
+    extend AdminCommand {
+        optional Command_ResetUserPassword ext = 1016;
+    }
+    optional string user_name = 1;
+}

libcockatrice_protocol/libcockatrice/protocol/pb/command_report_list.proto

@@ -6,4 +6,6 @@ message Command_ReportList {
         optional Command_ReportList ext = 1200;
     }
     optional bool unresolved_only = 1;
+    optional uint32 offset = 2 [default = 0];
+    optional uint32 limit = 3 [default = 100];
 }

libcockatrice_protocol/libcockatrice/protocol/pb/moderator_commands.proto

@@ -168,13 +168,6 @@ message Command_GetModeratorLastLogins {
     }
 }
 
-message Command_ResetUserPassword {
-    extend ModeratorCommand {
-        optional Command_ResetUserPassword ext = 1016;
-    }
-    optional string user_name = 1;
-}
-
 message Command_RemoveUserAvatar {
     extend ModeratorCommand {
         optional Command_RemoveUserAvatar ext = 1017;

libcockatrice_protocol/libcockatrice/protocol/pb/response.proto

@@ -53,6 +53,7 @@ message Response {
         RespClientUpdateRequired = 35; // Client is missing features that the server is requiring
         RespServerFull = 36;           // Server user limit reached
         RespEmailBlackListed = 37;     // Server has blocked the email address provided for registration for some reason
+        RespPasswordChangeRequired = 38; // Server requires the user to change their password before proceeding
     }
 
     // Type of response, used to route handling on the client

libcockatrice_protocol/libcockatrice/protocol/pb/response_report_list.proto

@@ -7,4 +7,5 @@ message Response_ReportList {
         optional Response_ReportList ext = 1210;
     }
     repeated ServerInfo_Report reports = 1;
+    optional uint32 total_count = 2;
 }

libcockatrice_protocol/libcockatrice/protocol/pb/session_commands.proto

@@ -35,6 +35,7 @@ message SessionCommand {
         REPLAY_GET_CODE = 1104;
         REPLAY_SUBMIT_CODE = 1105;
         REPORT = 1200;
+        // 1201-1203 reserved: removed during squash
         REPORT_MY_LIST = 1204;
         REPORT_ADD_COMMENT = 1205;
         REPORT_DETAILS = 1206;