fix(banlist): hide comment author/editor under banlist.hideadminname (#1500)

[rumblefrog]

Summary

Closes #1500.

banlist.hideadminname masked the focal ban/comm admin name and the unban "removed by" admin for public viewers, but the per-row comment author and editor (also admin usernames) leaked across every comment surface:

• the inline <details> comment disclosure on the public banlist + commslist,
• the ?comment=N "Other comments" comment-edit view (reachable by any caller, no admin gate),
• the JSON drawer (bans.detail / comms.detail) rendered by theme.js.

This suppresses the comment author + editor for public callers when hideadminname is on, matching the existing focal admin.name / removed_by gate.

Changes

• Data layer (page.banlist.php, page.commslist.php): null comname / editname for public viewers on both the inline-disclosure path and the ?comment=N othercomments path, so a third-party theme rendering the name directly can't re-leak it. edittime is preserved so the "last edit" indicator still shows.
• Templates (page_bans.tpl, page_comms.tpl): three-way Hidden / name / "deleted admin" branch for author and editor; the edit line now gates on edittime (not the now-nullable editname).
• API (bans.php, comms.php): null comment author / edited_by and add an author_hidden boolean sentinel.
• Drawer (theme.js, partials/player-drawer.tpl): use author_hidden to render "Hidden" (policy) distinctly from "unknown" (deleted admin → author already null).

Defense-in-depth: the name is removed at the data/API layer (protects custom themes and curl callers), with the default theme rendering the nicer "Hidden" placeholder on top.

Test plan

• BanlistCommentsVisibilityTest — inline disclosure + ?comment=N author/editor-hidden branches + admin control (13 tests, 47 assertions).
• BansTest / CommsTest::testDetailHidesCommentAuthorForPublicWhenHideAdminName — API author / edited_by / author_hidden contract for public + admin (94 tests, 462 assertions).
• Snapshot bans/detail_admin_view.json updated for the new author_hidden field.
• PHPStan clean (level 5).

Notes

Out of scope (separate follow-up, not a name leak): the ?comment=N comment-edit view renders comment bodies regardless of config.enablepubliccomments. Documented as a known follow-up in the AGENTS.md row.