feat: MSC4260 Report User, Bug #6 mutual exclusion, TDS toast compliance

- Add ReportUserModal.tsx — category dropdown + reason input, calls
  POST /_matrix/client/v3/users/{userId}/report via mx.http.authedRequest,
  inline success/error feedback, auto-closes 1500ms after success
- Wire Report User button into UserRoomProfile.tsx between UserModeration
  and UserDeviceSessions (hidden for own profile)
- Bug #6: enforce mutual exclusion between chat backgrounds and seasonal
  themes — ChatBgGrid clears seasonal→'off' on non-'none' pick;
  SeasonalBgGrid clears chatBackground→'none' on real theme pick;
  SeasonalEffect guards against legacy persisted state at render time
- TDS: strip all hardcoded hex/rgba fallbacks from LotusToastContainer.tsx
  (var(--lt-bg-card), --lt-accent-orange, --lt-text-primary/secondary,
  --lt-accent-orange-dim/border, --lt-box-glow-orange)
- Mark Bug #6 FIXED, MSC4260 DONE, toast TDS FIXED in LOTUS_BUGS.md and
  LOTUS_TODO.md; note EventReaders + CallControls already compliant

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

LOTUS_TODO.md

@@ -7,10 +7,10 @@
 
 ## 🏗️ Infrastructure & Maintenance
 
-- [ ] **Upgrade Synapse to v1.155.0**
-  - **Context:** Synapse 1.155.0 is the last version supporting Debian 12 Bookworm.
-  - **Reference:** https://github.com/element-hq/synapse/releases/tag/v1.155.0
-  - **Plan:** Review release notes, backup database and media store on LXC 151, perform upgrade in a staging environment if possible, then production. Prepare for OS migration to Debian 13 afterward.
+- [x] **Upgrade Synapse to v1.155.0** ✅ Done 2026-06-18
+  - **Context:** 1.155.0 is the last version supporting Debian 12 Bookworm. LXC 151 is already on Debian 13 Trixie — OS migration was completed prior to this upgrade.
+  - **What changed (1.154→1.155):** No breaking changes, no config changes, no DB migrations. Bugfixes: to-device EDU size limiting, restricted room joins, sliding sync subscription response timing. Rust port of more internal classes (perf only).
+  - **MSC4452** (Preview URL capabilities) shipped in 1.154 — opt-in via `msc4452_enabled`, not enabled.
 
 ---
 
@@ -52,18 +52,18 @@ Status: `[ ]` pending · `[~]` in progress · `[x]` completed
 ## Server Capabilities (as of June 2026)
 
 - **Homeserver:** `matrix.lotusguild.org`
-- **Synapse version:** `1.153.0` (2026-05-19) — fully up to date
+- **Synapse version:** `1.155.0` (2026-06-18) — fully up to date; last version for Debian 12 (LXC 151 already on Debian 13 Trixie)
 - **Matrix spec:** up to `v1.12` formally; newer MSC features via `unstable_features`
 
 ### Confirmed facts
 
 | Finding                                                                                              | Impact                                                                         |
 | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
-| **MSC flags ON:** `msc4140` · `msc3771` · `msc3440.stable` · `msc4133.stable` · `simplified_msc3575` | All safe to use now                                                            |
+| **MSC flags ON:** `msc4140` · `msc3771` · `msc3440.stable` · `msc4133.stable` · `simplified_msc3575` · `msc4222` · `msc3266` · `msc3401_matrix_rtc` | All safe to use now                                                            |
 | **MSC flags OFF:** `msc4306` (thread subscriptions) · `msc3882` · `msc3912` · `msc4155`              | These features are BLOCKED                                                     |
-| **MSC3266** room summary: returns 404                                                                | Room Preview feature BLOCKED                                                   |
+| **MSC3266** room summary: flag `msc3266_enabled: true` set but `GET /v1/rooms/{id}/summary` still returns 404 (M_UNRECOGNIZED) | Room Preview BLOCKED — endpoint not implemented in Synapse 1.155              |
 | **MSC3892** relation redaction: not in flags                                                         | Reaction Redaction feature BLOCKED                                             |
-| **MSC4260** report user: server at v1.12, endpoint may not exist                                     | Report User feature BLOCKED                                                    |
+| **MSC4260** report user: `POST /_matrix/client/v3/users/{userId}/report` returns **200** ✅          | **Report User UNBLOCKED** — endpoint live since Synapse 1.133; ready to build |
 | **MSC4151** report room: HTTP 405 on GET = endpoint exists (POST only)                               | Report Room live ✅                                                            |
 | `folds AvatarImage` does NOT accept children                                                         | Add frame/overlay inside `UserAvatar.tsx` itself — optional `frameName` prop   |
 | No in-app toast system exists (was)                                                                  | Built `ToastProvider` + Jotai queue; at `App.tsx:65`                           |
@@ -467,9 +467,9 @@ Check back after each Synapse upgrade — re-run `/matrix/client/versions` and `
 
 ### [BLOCKED] · Room Preview Before Joining (MSC3266)
 
-**Blocked by:** `GET /v1/rooms/{id}/summary` returns 404 — endpoint not available on this server  
+**Blocked by:** `GET /_matrix/client/v1/rooms/{roomId}/summary` returns `M_UNRECOGNIZED` 404 — endpoint not implemented in Synapse 1.155. Config flag `msc3266_enabled: true` is set but has no effect; Synapse appears not to have shipped a stable implementation at the v1 path. Verified 2026-06-18.  
 **What it would do:** Show room name, topic, avatar, member count before joining.  
-**Action when unblocked:** Build pre-join preview card; trigger on unjoined room navigation.
+**Action when unblocked:** Re-test after each future Synapse upgrade.
 
 ### [BLOCKED] · Thread Subscriptions (MSC4306)
 
@@ -477,12 +477,12 @@ Check back after each Synapse upgrade — re-run `/matrix/client/versions` and `
 **What it would do:** Follow a thread without posting; get notifications for replies.  
 **Action when unblocked:** Add "Follow thread" button in the thread panel header (depends on #P3-8 Thread Panel).
 
-### [BLOCKED] · Report User (MSC4260)
+### [DONE] · Report User (MSC4260) ✅
 
-**Blocked by:** Server declares only spec v1.12; MSC4260 merged in v1.14 — endpoint may not exist  
-**What it would do:** Report a specific user to homeserver admins (separate from reporting a message).  
-**Note:** Report Message already exists in upstream Cinny. This would add Report User to the profile panel.  
-**Action when unblocked:** Test `POST /_matrix/client/v3/users/{userId}/report`; if 200, add button to user profile.
+**Previously blocked by:** Server spec v1.12, but `POST /_matrix/client/v3/users/{userId}/report` was confirmed **200** on 2026-06-18 (live since Synapse 1.133.0).  
+**What it does:** Reports a specific user to homeserver admins (separate from reporting a message).  
+**Note:** Report Message already exists in upstream Cinny. This adds Report User to the profile panel.  
+**Implemented 2026-06-18:** `ReportUserModal.tsx` added at `src/app/features/room/ReportUserModal.tsx`. Button wired into `UserRoomProfile.tsx` between UserModeration and UserDeviceSessions (hidden for own profile). Category dropdown + reason text, inline success/error feedback, auto-close 1500ms after success.
 
 ---