feat(coal): a scam account loses every link, not only the reported ones

Problem

Hiding a phishing address depends on someone having seen it first and added it to a list. The account posting it is already marked as a scam by the abuse list, yet its next address reaches readers before anyone can list it. Losing that race once is a reader handing over their keys.

Cause

The two defences are independent. The abuse list judges the account and withholds its content behind a warning the reader can step past; the address list is maintained by hand, one entry at a time. A reader who chooses to see the content gets whatever links it carries unless each one has already been listed.

Change

• Content from an account the abuse list marks as a scam has all of its links replaced, the same treatment accounts on the static bad-actor list already receive. The mechanism is the one already in place for that list, applied to this condition as well.
• The reader can still reveal and read the text. There is simply nothing left to click.
• Both places that render an author's body are covered: a full post and a comment.

This does not replace listing addresses. The list still protects every reader from a known address wherever it appears, including from accounts nobody has listed yet. The two are complementary: one judges the address, the other the account.

Verification

• The existing tests for the detector and for the markup renderer pass.
• The detector is the same one that drives the warning, so an account cannot be judged for one and not the other.