P7: Lemmy's Warn and Resolve{Flag}

- A Warn from a community's moderator about a persona's own post there becomes that persona's moderation_warning
  notification (Mastodon's AccountWarning, with the reason and the post), believed from the community's own server or
  from an account the community's moderators collection lists. Remote communities keep that collection's address
  (attributedTo) as ForeignAvatar.ModeratorsURL; it is read only when a warning needs it.
- A Resolve{Flag} for one of our reports (`/grunts/flag-<report id>`) is kept as the report's remote resolution when it
  comes from the server holding what was reported, or the community it was reported to; our own moderators'
  resolution is never replaced. The moderators' report list shows both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Federation/Inbox/Communities.cs

@@ -1,7 +1,14 @@
 using MongoDB.Entities;
 
+using PrivaPub.Federation.Actors;
+using PrivaPub.Federation.Objects;
+using PrivaPub.Models.User;
 using PrivaPub.StaticServices;
 
+using System.Text.Json.Nodes;
+
+using static PrivaPub.Federation.Objects.ActivityJson;
+
 using PostEntity = PrivaPub.Models.Post.Post;
 
 namespace PrivaPub.Federation.Inbox
@@ -20,5 +27,23 @@ namespace PrivaPub.Federation.Inbox
 			}
 			return default;
 		}
+
+		// whether an account may act for a community's moderators: anyone on the community's own server (its admins and
+		// moderators, as Lemmy's verify_mod_or_admin_action allows), or an account its moderators collection lists
+		public static async Task<bool> Moderates(ForeignAvatar community, string actorUri, IRemoteActorService remoteActors, CancellationToken token)
+		{
+			if (actorUri == default || community == default)
+				return false;
+			if (Origin.Same(actorUri, community.ActorURI))
+				return true;
+			if (string.IsNullOrEmpty(community.ModeratorsURL))
+				return false;
+			using var fetched = await remoteActors.FetchObject(community.ModeratorsURL, token);
+			if (fetched == default)
+				return false;
+			var collection = JsonNode.Parse(fetched.Root.GetRawText());
+			var items = collection?["orderedItems"] ?? collection?["items"] ?? collection?["first"]?["orderedItems"] ?? collection?["first"]?["items"];
+			return items is JsonArray listed && listed.Any(item => Id(item) == actorUri);
+		}
 	}
 }