v2.37.0 — replies stay visible under removed comments and a spam-thread action

Highlights:

• Replies survive a removed parent. Marking a comment spam, holding it for moderation, or a moderator delete no longer hides its approved replies. The parent renders as an anonymous "[removed by a moderator]" placeholder; a hidden comment with no visible replies renders nothing (#189).
• Spam thread. The admin comment detail page has a Spam thread action that marks a comment and every reply below it spam in one atomic step, up to 100 comments. Each changed row gets a thread.spam audit entry with prev_status, so it can be undone. One comment.spam webhook fires, for the root only.
• Queue reply hint. Spam and pending rows show "↳ N direct replies".

fix:

• Replies to a spam comment, or to someone else's pending comment, are refused like a missing parent.
• Admin bulk moderation runs a fixed number of D1 queries and no longer 404s or hits the bind-parameter cap on large selections. Bulk delete now records the removal as a moderator delete.
• New log events: comment.requarantined when an edit sends an approved comment back to pending; comments.page_truncated also fires on the 4,000-row scan cap (scan_limit).

No new env vars, endpoints or migrations. Drop-in upgrade.