feat(settings): add the per-repo contributor blacklist config layer (#1425)

[JSONbored]

Summary

The config + resolution layer for a configurable contributor blacklist (#1425) so banned offenders (plagiarists / farmers) can be handled automatically by the converged engine instead of by hand. This PR is the data layer only — no behavior change yet (the resolved list is unused, so the engine is byte-identical); the deterministic disposition lands in the next PR of the stack.

Modular + config-driven, never hard-coded for any repo — layered exactly like every other setting (.gittensory.yml > DB), mirroring the commandAuthorization / linked-issue hard-rule wiring:

• ContributorBlacklistEntry (src/types.ts): a public GitHub login + optional public-safe metadata (reason e.g. plagiarism/farming, evidence PR/issue URLs, addedAt). No wallets/hotkeys/trust-scores/private values.
• RepositorySettings.contributorBlacklist + the repository_settings.contributor_blacklist_json column (migration 0072, default [] → existing rows byte-identical).
• Config-as-code parity in every site, same PR: the DB read/serialize + parse helper (src/db/repositories.ts), the .gittensory.yml settings: overlay (src/signals/focus-manifest.ts), OpenAPI (regenerated), and the settings PUT route (src/api/routes.ts).
• src/settings/contributor-blacklist.ts (pure): normalizeContributorBlacklist (login-pattern validation, public-safe metadata, case-insensitive de-dup, caps), findBlacklistEntry / isAuthorBlacklisted (case-insensitive), and mergeContributorBlacklists — the global-union primitive for unioning the shared/global list with the per-repo list at the point of use.

Part of #1425 (and the #1409 anti-abuse epic).

Scope

• Backend (src/) + a DB migration + the regenerated OpenAPI
• No behavior change (resolved list is unused this PR) — flag-free + byte-identical engine
• Config-as-code parity wired in every site (migration, Drizzle/types, resolver, .gittensory.yml, OpenAPI, route)

Validation

• npm run test:ci — green; db:migrations:check contiguous (0072); ui:openapi:check clean (regenerated)
• npm run test:coverage — every changed line and branch covered (verified against coverage/lcov.info)
• npm audit --audit-level=moderate — 0 vulnerabilities; typecheck/ui:typecheck clean; git diff --check clean
• Tests: the resolver (bare-string + object entries, every invalid-login arm, de-dup, caps, metadata trim/cap/omit, find/isBlacklisted match+miss, merge union + first-wins + empty); the .gittensory.yml settings: overlay (yml > DB, malformed never blanks the DB list); and a DB round-trip (persists + resolves, drops invalid entries; empty default for an unconfigured repo).

Safety

• No secrets / wallets / hotkeys / coldkeys / trust scores / reward values added — entries carry only a public login + public-safe metadata
• No behavior change: nothing acts on the list yet, so no PR/issue is affected by this PR
• Validation drops malformed entries (login pattern, caps) so a bad list can never widen a match or break the future close path

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	54de4fc	Commit Preview URL Branch Preview URL	Jun 26 2026, 07:02 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.39%. Comparing base (545b84b) to head (54de4fc).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1429      +/-   ##
==========================================
+ Coverage   95.38%   95.39%   +0.01%     
==========================================
  Files         192      193       +1     
  Lines       20875    20929      +54     
  Branches     7548     7564      +16     
==========================================
+ Hits        19912    19966      +54     
  Misses        383      383              
  Partials      580      580              

Files with missing lines	Coverage Δ
src/api/routes.ts	94.60% <ø> (ø)
src/db/repositories.ts	96.10% <100.00%> (+<0.01%)	⬆️
src/db/schema.ts	68.32% <ø> (ø)
src/openapi/schemas.ts	100.00% <ø> (ø)
src/settings/contributor-blacklist.ts	100.00% <100.00%> (ø)
src/signals/focus-manifest.ts	98.12% <100.00%> (+0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.