* Add backend support for editing media attachments of existing posts

* Allow editing media attachments of already-posted toots

* Add tests

* Fix /api/v1/admin/trends/tags using wrong serializer

Fix regression from #18641

* Only use `REST::Admin::TagSerializer` when the user can `manage_taxonomies`

* Fix admin trending hashtag component to not link if `id` is unknown

* Allow changing hide_collections setting with the api

This is currently only possible with app/controllers/settings/profiles_controller.rb
and is the only difference in the allowed parameter between the two controllers

* Fix the lint issue

* Use normal indent

* Fix changing domain block severity not undoing individual account effects

Fixes #22133

* Add tests

Co-authored-by: Nonexistent <nx@example.org>

* Log admin approve and reject account

* Add unit tests for approve and reject logging

Fixes #21965

Fixes regression from #20860

* Fix missing pagination headers on followed tags

* Fix typo

Several controlers set quite intricate Cache-Control headers in order to
hopefully not be cached by any intermediate proxies or local caches. Unfortunately,
these headers are processed by ActionDispatch::HTTP::Cache in a way that squashes
and discards any values set alongside no-store other than private:
8015c2c2cf/actionpack/lib/action_dispatch/http/cache.rb (L207-L209)

We want to preserve no-store on these responses, but we might as well remove
parts that are going to be dropped anyway. As many of the endpoints in these
controllers are private to a particular user, we should also add "private",
which will be preserved alongside no-store.

* Move V2 Filter methods under /api/v2 prefix

* move over the tests too

Fix #19156

Fix #19157

* Remove dead code

* Remove unneeded/broken parameters and refactor descendant computation

```ruby
10.times { p /#{FOO}/.object_id }
10.times { p FOO_RE.object_id }
```

* Make account endorsements idempotent (fix #19045)

* Accept suggestion to use exists? instead of find_by + nil check

Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>

* fix logic (unless, not if)

* switch to using `find_or_create_by!`

Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>

New environment variable `DISALLOW_UNAUTHENTICATED_API_ACCESS`

Fix #19153

Fix #19542

Fix #19213

- Only exact search matches for queries with < 5 characters
- Do not support queries with `offset` (pagination)
- Return HTTP 401 on truthy `resolve` instead of overriding to false

* Change featured tag updates to add/remove activity

* Fix to check for the existence of feature tag

* Rename service and worker

* Merge AddHashtagSerializer with AddSerializer

* Undo removal of sidekiq_options

* Add LIMIT of featured tag to instance API response

* Add featured_tags_collection_url to Account

* Add synchronization of remote featured tags

* Deliver update activity when updating featured tag

* Remove featured_tags_collection_url

* Revert "Add featured_tags_collection_url to Account"

This reverts commit cff349fc27.

* Add hashtag sync from featured collections

* Fix tag name normalize

* Add target option to fetch featured collection

* Refactor fetch_featured_tags_collection_service

* Add LIMIT of featured tag to v1/instance API response

Cherry-picked d2528b26b6

Conflicts:
- `app/serializers/initial_state_serializer.rb`:
  Upstream changed stuff, we had extra attributes.
  Applied upstream changes while keeping our extra attributes.
- `app/serializers/rest/instance_serializer.rb`:
  Upstream actually moved that to `app/serializers/rest/v1/instance_serializer.rb`,
  so updated that file by keeping our extra attributes, and took upstream's
  version of `app/serializers/rest/instance_serializer.rb`.
- `spec/views/about/show.html.haml_spec.rb`:
  Took upstream's version.

Source string no longer localized, Markdown instead of raw HTML

In the absence of an opt-in to multiple specific languages in the
preferences, it makes more sense to filter by the user's presumed
language only (interface language or `lang` override)