feat(moderation): report and ban note replies (substack.com host) #26

Why

comments report posts to /api/v1/comment/{id}/report on the publication host (moderation_core.py:115). Note replies live on substack.com (host "A"), so a fake-"Charlie" reply under a note can't be reported with the current command. This is flagged at README.md:226. Substack has cleared us (Oct 12 call) to report impersonators automatically from an admin account, and Notes is where they now operate.

What

• Add --surface notes (or --host A) to comments report so it can report a note or note reply.
• Confirm whether comments ban (/api/v1/comment_ban/{comment_id}) accepts a note-reply id and bans the user from the publication. If it needs a different endpoint for Notes, add it.
• report-user already uses host A (moderation_core.py:126), so no change there.

Done when

• A note reply can be reported (and, if supported, banned) via the CLI, verified with --dry-run first and then one live report on a confirmed scam reply.
• The write gate and dry-run defaults from feat: comment-moderation commands — report, ban, report-user, bans, moderation helpers #18 are kept.