Fix database-backed command execution and tab completion

[remdui]

Summary

• run /unban, /unmute, and /unbanip database-backed suggestions through feature-scoped background tasks instead of Velocity command/Netty threads
• stop requesting suggestions after each command's final supported argument
• replace the nullable Map.entry(...) sanction target resolution path with a null-safe persisted identity lookup that returns usernames only
• wrap the friends command so database-backed execution and tab completion run outside Velocity event threads
• return immediately for terminal friend subcommands such as /fr acceptall, /fr denyall, /fr disable, and /fr enable, avoiding unrelated database queries on TAB
• guard fixed-arity friend subcommands against suggestions after their final argument
• convert friend command/suggestion failures into controlled empty results or the existing data-unavailable message rather than uncaught console errors
• run /2fa reset <TAB> account-store and persisted-identity lookups through the feature task manager, with prefix filtering, limits, and failure isolation

Repository-wide related-problem audit

Reviewed all FeatureCommand.suggestAsync implementations, Brigadier suggestion providers, and command classes that directly reference ORM contexts or database-backed services.

The remaining completion providers use online-player snapshots, immutable command metadata, configuration, or in-memory registries. They do not perform the database-backed identity resolution that caused the Friends/Sanctions failures. The additional related issue found was /2fa reset <TAB>, which has now been fixed and covered by regression tests.

Root causes

1. SanctionsService.suggestActiveTargetNames created Map.entry(playerId, username) even when the username resolver returned null; Map.entry rejects null values and caused the reported transaction stack trace.
2. Player identity resolution intentionally avoids blocking persistence on event/Netty threads. Database-backed suggestions were invoked synchronously there, so offline identities could become unresolved database IDs or null UUIDs.
3. FriendCommand.suggestAsync eagerly loaded every friend/request/block collection before deciding which subcommand was being completed. This meant even /fr acceptall <TAB> queried unrelated data despite accepting no argument.
4. Friend command execution itself also performed ORM-backed work on the command thread, explaining first-use failures such as /fr list while caches were cold.
5. /2fa reset <TAB> synchronously called the ORM-backed account store and persisted player resolver from the command thread.

Validation

• regression tests cover null-safe sanction username resolution, asynchronous sanction suggestions, terminal friend subcommands, fixed-arity completion, asynchronous friend command execution, and asynchronous 2FA reset suggestions
• each functional fix and coherent regression-test set is isolated in its own commit
• CI performs the complete Maven build and coverage checks

Reported evidence

The supplied production trace points to SanctionsService.suggestActiveTargetNames and Map.entry as the immediate /unban//unmute tab-completion failure.