instance blocking

the initial implementation could just have blocked instances in the config, but for easier moderation it (the entire config perhaps) should be put in a db table

- activities from blocked instances are dropped silently (i.e. return the normal status code for the inbound request)
- when an instance is blocked, all content from that instance should be deleted?
- instance blocking could be done before http signatures are verified, but I've heard there's some pitfalls
- provide some client endpoint for getting the list of blocked instances

Start by reviewing the configuration, inbound request handling around HTTP signature verification, and any existing client endpoints. Clarify how blocked instances are stored, whether their content is deleted, and which endpoint exposes the list. Done means the moderation behavior, storage model, deletion policy, and endpoint contract are agreed and implemented.

Written by the indexing model from the issue text.