dev: Scam file purge helper

[isTravis]

Adds a new Scam Files tab to the superadmin dashboard for handling phishing/malware reports on assets.pubpub.org. Previously, responding to these reports required manually running S3 commands and CDN purge API calls. This tab provides a guided workflow with status verification at each step.

I have only tested this locally, where there aren't the same spam files that are being reported from prod. This will likely need a couple iterations to work out bugs that we'll only find once deployed.

Workflow

1. Paste the reported URL directly from the email (defanged formats like hxxps://assets.pubpub[.]org/... are handled automatically)
2. Copy the file to the reported-scams S3 bucket (preserving the key as an archive)
3. Delete the file from assets.pubpub.org
4. Purge Fastly cache (single-URL purge, not zone-wide)
5. Purge Cloudflare cache (single-URL purge, gated until Fastly is confirmed clear)

A Check Status button queries each layer independently — S3 via HeadObject (bypasses CDN), and a HEAD request to the CDN URL to inspect cf-cache-status, x-cache, and other headers — so you can verify the file is fully gone before and after each step.

The check also searches User and Community image fields for references to the asset key. If an associated account is found, it displays the current spam status and provides quick Mark Spam / Mark Not Spam buttons (using the existing spamTags API).

New env var required

CLOUDFLARE_CACHE_PURGE_API_TOKEN — a Cloudflare API token with Zone > Cache Purge > Edit permission. The tab warns if this isn't set but doesn't block the other steps.