MPCAutofill/cardpicker: contextual report panel and per-user hidden card feed exclusion

[WilfordGrimley]

Summary

Closes #714 — "What's That": contextual report button that flags an image for moderators against the relevant tags, with an optional per-user hide.

Backend

• HiddenCard model + migration 0108_hiddencard (stacks on master's 0107_question_feed_pools_schedule_dedupe, keeping the migration graph a single leaf).
• post_report_card accepts an optional hide flag: when true, creates a HiddenCard for the reporting anonymous identity inside the same transaction as the CardReport.
• Question feed excludes the requesting voter's hidden cards from every tier (question_feed_pools threading + per-voter filter in question_feed.py). No caching added — the latency caching is master's own content and is untouched.

Frontend

• Report panel gains an "Also hide this image for me" checkbox; when checked, the report request carries hide: true and the card is hidden locally.
• hiddenCardsSlice + listener middleware persist hidden identifiers to localStorage keyed by anonymous identity; Layout hydrates the slice at app start for an existing identity only (never mints a new one just by loading).
• The card-detail modal is gated on the hidden-identifier set, so a hidden card cannot be reopened from the feed.
• When unchecked, the wire payload is byte-identical to the pre-What's That: contextual report button — flag an image for moderators against relevant tags, with optional per-user hide #714 request (hide is undefined and dropped by JSON.stringify).

Test plan

• python3 -m pytest cardpicker/tests/test_question_feed.py cardpicker/tests/test_question_feed_pools.py -q — 106 passed
• python3 -m pytest cardpicker/tests/test_moderation_views.py -q — 48 passed
• black --check on the 9 touched Python files — clean
• isort --check-only --profile black cardpicker/ — clean
• ruff check on touched Python files — clean
• mypy --config-file ../mypy.ini on the touched production files — Success: no issues found in 5 source files
• .github/scripts/check_migration_leaves.py --base origin/master — OK, one leaf per app
• npm run build (frontend) — compiled successfully
• npx jest src/common/cookies.test.ts src/features/reporting/ReportCardPanel.test.tsx — 27 passed
• pre-commit prettier (v2.7.1) — Passed
• pre-commit eslint — Passed
• Note: the full local jest suite shows 22 failures in searchSettings/comparison.test.ts (TypeError: a.isSubsetOf is not a function). That file is byte-identical to master; the tests use Set.prototype.isSubsetOf (Node 22 API) and fail only under the local Node 20. CI runs Node 22.15.
• CI — not watched by this session per dispatch convention