Record + surface when/why a user was frozen

Most of the time I have no insight into why a user was frozen without searching externally. User.is_frozen is just a bool so it has no timestamp, no actor, no reason, etc. and none of the freeze paths emit a user event, so the admin user detail page shows nothing about it.

lets:

• add an event so freeze/unfreeze is recorded with when + who + why. User is already HasEvents, so it renders in the existing Events table on the admin detail page (user.events is unfiltered) — no template change needed just to see it there.
  • but: User events are not admin-only. The same event stream feeds the end user's own "Security history" (account.html renders user.recent_events, which filters only by source_id + 90 days, no tag filter). A raw freeze event would surface "you were frozen by admin X, reason: Y" on the frozen user's own account page. Freeze/unfreeze is an admin-centric operation, so exclude those tags from the user-facing feed — either in User.recent_events or in the account.html loop — while leaving user.events (admin detail) unfiltered.
• add admin UI for adding the reasoning: the freeze confirm view only asks you to retype the username today; add a reason field and store it on the event
• add admin UI enhancements to better show user frozen w/ reason: surface frozen state + reason prominently on the detail page (not buried), instead of just the Frozen checkbox

what's missing today

• no EventTag.Account.AccountFreeze / AccountUnfreeze; no record_event on any freeze path
• freeze happens in several places, all silent (except malware, which writes a project journal entry, not a user event):
  • warehouse/admin/views/users.py:469 — the Freeze button (user_freeze)
  • warehouse/admin/views/users.py:174 — the Frozen checkbox on the user-edit form (populate_obj, silent)
  • warehouse/utils/project.py:137 — project quarantine freezes owners
  • warehouse/admin/views/malware_reports.py:195,595 — malware freeze
• Journals are packaging operations, not user-level admin actions. The detail page's "Journals" table is scoped to JournalEntry.submitted_by == user (packaging actions the user performed on projects); separately, admins may have journal entries against packages these users own. Either way, freeze is a user-level admin action, not a package journal — so it belongs in the user Events log, not Journals.

user-facing filtering (the one gotcha)

• admin detail page → user.events → shows everything, incl. new freeze/unfreeze ✅
• user account page → user.recent_events → must not show freeze/unfreeze; add tag exclusion for AccountFreeze / AccountUnfreeze before display

edited re: mikes comments

---

Good First Issue: This issue is good for first time contributors. If you've already contributed to Warehouse, work on another issue without this label instead. If there is not a corresponding pull request for this issue, it is up for grabs. For directions for getting set up, see our Getting Started Guide.

If you are working on this issue and have questions, feel free to ask them here, in the #pypa-dev chat channel on Libera, the PyPA Discord or on the Discourse.

Screenshot Required: If your pull request makes a visual change, include a screenshot of your update. This helps our team give you feedback faster.