Allow projects to block users

Goal

Let a project owner prevent specific accounts from accessing or interacting with that project.

Acceptance criteria

• Project owners and authorized administrators can block and unblock a user from the project member/access page.
• A project cannot block its owner; unauthorized users cannot manage the block list.
• A block overrides member/read-only grants, public visibility, public issue submission, and other project access paths for that user.
• Blocking an existing member has a clearly defined, transactionally applied effect on their membership while retaining historical authorship, comments, and issue attribution.
• Blocked users are not offered as new members or assignees while the block remains active.
• Direct UI, API, MCP, attachment/object, and realtime access is rejected consistently without leaking private project details.
• The page shows the current block list and supports deliberate unblocking without exposing unrelated usernames.
• Add store, handler, authorization, realtime, and UI coverage for block, unblock, precedence over each access mode, existing membership, project owner protection, and direct-route attempts.