feat: add safe selective recovery for review mutations

[AllenXiao95]

Implements the Recovery slice of #46 without adding intentional-variant semantics yet.

What this adds

• Review recovery query grouped by existing audit_id, expanded to coordinate-level evidence.
• Per-coordinate before -> after -> current TM state for prior unify writes.
• revertible / conflict classification computed server-side.
• Selective batch revert by decision_id.
• Stale-decision protection: if any selected coordinate has a later TM/Review mutation or no longer matches the selected decision's written state, the whole batch fails closed with 409 ReviewConflict.
• Recovery appends to the existing Review decision log; no new provenance/audit store.
• Dashboard 变更历史 / Recovery function area with coordinate checkboxes and conflict-disabled rows.
• Existing immutable run/QA sidecars are not rewritten; after recovery the operator still creates a normal new run.

Important boundary

This PR does not implement the prevention half of #46 yet:

• no intentional_variant state;
• no context-aware same-source classifier;
• no change to TranslationUnit identity/source fingerprint;
• no Planner/TM reuse changes;
• no glossary auto-mutation;
• no change to same-source warning severity.

Regression coverage

• one bulk unify contains both correct and wrong coordinates;
• recovery exposes path/key/source + before/after/current;
• selecting only wrong coordinates restores only those before-images;
• one stale member rejects the entire selected batch before any restore;
• later human edit remains intact after a stale revert attempt;
• HTTP recovery route works and stale conflicts map to 409;
• dashboard root contains the Recovery function area.

Refs #46