Expose bounded live restriction status

[cmdr-chara]

Summary

• add a typed, creator-visible liveRestrictionStatus alongside the historical monthly report
• fetch current account labels from Gizmoduck and active post labels from at most 100 recent authored, non-retweet timeline entries within 30 days
• return applied/expiry timestamps only when supplied by the source and expose explicit coverage/truncation status
• keep provenance, model, appeal, actor, rule-id, and inferred surface metadata absent and listed unavailable

Security and privacy

The external GraphQL column resolves only authenticatedTwitterUserId; the keyed internal column retains its existing wrapper/admin ACL. Raw source, byUser, LDAP identities, internal actors, and rule IDs are never returned.

Verification

• git diff --check / git show --check
• Strato/Thrift delimiter balance, file-integrity, auth-wrapper invariants, and focused secret scan
• independent review of authorization, privacy, query bounds, freshness, and historical timestamp semantics

The public checkout has no Strato/Thrift compiler or build target, so typechecking/codegen could not be executed locally. Status is explicitly LIVE_BEST_EFFORT, limited to the newest 100 timeline edges and 30 days.