feat(banlist): demo download, comment gates, and in-place comment composer

[maxijabase]

Summary

Ports the security and demo-list pieces of upstream sbpp#1568, then replaces the public ?comment= page editor with composers that stay on the current view.

Demo download

• Public banlist rows (desktop + mobile) now have a demo download button, matching the drawer CTA from fix(banlist): surface demo download in the player drawer #26.

Comment and demo gates (from sbpp#1568)

• bans.add_comment / bans.edit_comment for submissions (S) and protests (P) require the matching BanSubmissions / BanProtests flags. A generic web admin can no longer write queue comments.
• Public ?p=banlist&comment= never opens an S/P editor, even when public comments are on.
• getdemo.php and bans.add demo attach stay under SB_DEMOS. A bad filename cannot leave an orphan ban or follow a symlink out of the demo root.

Comment composer (this follow-up; different from upstream)

Upstream sbpp#1568 still used a page-level ?comment= editor. We did not port that rewrite. Instead:

Banlist / commslist Add or Edit

• Before: navigate to ?p=banlist&comment= (or commslist). The list is replaced by a form. Scroll, page number, and open row state are lost.
• After: opens the player drawer composer. The list stays. After save, the row chip and inline comment list update without a reload.

Protest / submission cards

• Before: Add Comment bounced to the public banlist editor.
• After: inline composer on the same card. Save still reloads the queue (cards have no drawer).

Banlist / commslist / drawer Delete

• Before: after confirm, message.redir reloaded the list (or remounted the drawer). Page 3, mid-page scroll, and an open disclosure all reset.
• After: the comment <li> is removed in place. Pagination, scroll, open disclosure, and open drawer survive.

Public ?comment=

• Before: rendered a full-page editor and could leak S/P editors onto the public route.
• After: not an editor. The list still renders.

Mods chrome and dependency bumps from upstream sbpp#1568 stay out of this PR.

Test plan

• PHPUnit filter for the comment + demo-attach tests (BansTest, BanlistCommentsVisibilityTest, AdminEditBanDemoTest)
• Playwright banlist-comments-visibility.spec.ts (drawer compose, table patch on save, in-place table delete, in-place drawer delete)
• Playwright comment-delete-dispatcher.spec.ts (queue ctype P still confirms + calls the API)
• Confirm a demo download button appears on ?p=banlist for a row with a demo
• As a generic web admin without queue flags, S/P comment add/edit is rejected; with the matching flag it succeeds
• Add/Edit on banlist or commslist opens the drawer, not ?comment=
• Delete a comment on page 3 with the disclosure open: the comment is gone, scroll and page stay
• Delete a comment from the open drawer: the drawer stays open, no skeleton remount
• getdemo.php rejects symlink / path-escape filenames; bans.add rejects malformed or missing demo metadata before INSERT