[Server/Client/Protocol] Address PR #7091 review: security, bug, and perf fixes

Security:
- Promote RESET_USER_PASSWORD to admin-only dispatch (was moderator-accessible)
- Reject password reset on users with equal/higher privilege than caller
- Notify affected user via Event_NotifyUser::CUSTOM when password is reset
- Add server-side category whitelist for reports
- Drop reporter name fallback in comment/details authorization (ID-only)
- Force password change: new DB column + login enforcement + client disconnect

Bugs:
- XSS via QTextEdit::append() → insertPlainText() in report tab and utils
- allNotified initialized to true even with empty recipients list
- Warning combo box: use currentData() instead of baked-in display text
- Report resolution now records who resolved (resolved_by column + audit)

Performance:
- IP-correlation subquery: add 6-month window + LIMIT 200
- getUserSessions: clamp limit to 500

Non-blocking:
- Palette-aware colors in report_utils.cpp (dark/light mode)
- Report list pagination: offset/limit fields + total_count in response
- SessionCommand enum gap comment for reserved values 1201-1203

Schema: 36→37 (force_password_change), 37→38 (resolved_by)

Took 12 minutes


Took 16 seconds

libcockatrice_protocol/libcockatrice/protocol/pb/moderator_commands.proto

@@ -168,13 +168,6 @@ message Command_GetModeratorLastLogins {
     }
 }
 
-message Command_ResetUserPassword {
-    extend ModeratorCommand {
-        optional Command_ResetUserPassword ext = 1016;
-    }
-    optional string user_name = 1;
-}
-
 message Command_RemoveUserAvatar {
     extend ModeratorCommand {
         optional Command_RemoveUserAvatar ext = 1017;