#40724 chore: migrate five more client DDP callers to new REST endpoints

Summary

Continues the DDP→REST sweep started in #40711. Adds five brand-new REST endpoints to replace the last batch of DDP methods that had direct client callers but no REST equivalent. The DDP methods stay registered on the server (so external SDK/mobile clients keep working) but each one now emits a methodDeprecationLogger.method(NAME, '9.0.0', '/v1/...') line pointing at the new route, and delegates to a shared server function so the business logic isn't duplicated.

New endpoints

DDP method	New REST endpoint	Notes
deleteCustomSound	POST /v1/custom-sounds.delete	manage-sounds perm
blockUser / unblockUser	POST /v1/users.block / POST /v1/users.unblock	Per-room RoomMemberActions.BLOCK directive; unblock keeps DDP's existing no-perm-check behavior (flagged below)
saveSettings	POST /v1/settings.bulk	twoFactorRequired (disableRememberMe); same per-setting perm chain as the DDP method
e2e.requestSubscriptionKeys	POST /v1/e2e.requestSubscriptionKeys	No body; fans out notify.e2e.keyRequest

Client callers migrated

• EditSound.tsx (useMethod → useEndpoint)
• useBlockUserAction.ts (binds both endpoints, keeps the isUserBlocked ? unblockUser : blockUser ternary)
• SettingsProvider.tsx (now sends { settings: [...] })
• rocketchat.e2e.ts (non-hook caller uses sdk.rest.post)

Known follow-ups

• unblockUser has no permission check today; this PR preserves that parity to avoid silent regression. Worth gating behind RoomMemberActions.BLOCK (or its unblock counterpart) in a follow-up.
• Two e2e specs still drive deleteCustomSound / saveSettings through /v1/method.call (apps/meteor/tests/end-to-end/api/custom-sounds.ts, apps/meteor/tests/end-to-end/api/methods.ts). They keep working because the DDP methods stay registered; TODO comments are in place to migrate them when the deprecated DDP methods are removed in 9.0.0.

Test plan

• CI green (lint + typecheck + meteor lint pass with rebuilt rest-typings dist)
• Admin → Custom Sounds → delete a sound → row disappears, success toast
• DM user info → Block, then Unblock → subscription blocker/blocked flags flip, both endpoints emit subscription-changed broadcasts
• Admin → General → toggle a setting, Save → 2FA prompt appears, save succeeds, audit log records change
• Fresh device in an E2E channel → server logs show notify.e2e.keyRequest fan-out

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Introduced REST API endpoints as replacements for legacy methods: /v1/e2e.requestSubscriptionKeys, /v1/im.blockUser, /v1/settings (bulk), and /v1/custom-sounds.delete.

• Deprecations

  • DDP methods (e2e.requestSubscriptionKeys, blockUser, unblockUser, saveSettings, deleteCustomSound) now emit deprecation notices directing users to corresponding REST endpoints. Methods remain functional until version 9.0.0.

Task: ARCH-2177