refactor: converge Review recovery and dashboard delivery

[AllenXiao95]

Convergence follow-up to #46 after #47-#50 exposed several layers of Recovery-specific patching.

This PR keeps the Recovery product capabilities but removes duplicate/implicit implementation paths:

• ReviewDecisionEvent remains schema-v1 compatible but new TM mutation decisions persist a complete after row snapshot; legacy events without after still parse unchanged.
• Production Dashboard Review services use one shared process-local TM maintenance RLock with TaskService, closing in-process task/review admission races.
• New CoordinatedReviewService snapshots post-write TM state into ReviewDecisionLog events and conservatively compensates a commit if an external log revision race is detected.
• safe_revert becomes the single recovery implementation. Freshness evidence resolves in order: recorded after-image -> immutable ReviewIndex -> strict legacy before-image anchor. safe_revert_with_history_fallback remains only as a compatibility alias.
• Revert now records its own before/after state and compensates TM if the authoritative Review log append fails.
• Project history large-audit responses are actually bounded: operations over 200 coordinates return summary only; /api/review/history/coordinates owns paged coordinate inspection/search/recovery.
• server.py no longer monkey-patches server_impl._Handler at import time. Review history/recovery is a normal handler subclass and DashboardServer uses explicit handler_class / review_service_class composition.
• The actual product Dashboard (localizer.web.DashboardServer) composes Review assets with i18n/workflow presentation through render_index_html, removing the temporary global-handler swap that could bypass Review UI delivery.
• Regression coverage checks legacy log compatibility, after-image recovery without old run sidecars, large-audit summary behavior, real product Dashboard composition, and shared Task/Review TM locking.

Deliberate boundaries:

• no [Review] Preserve intentional context-specific variants during same-source consolidation #46 same-source Prevention semantics in this PR;
• no generic event-sourcing/replay framework;
• no TU identity/source-fingerprint/Planner changes;
• server_impl.py remains as the compatibility/base transport implementation; the behavioral facade/monkey-patch layer is what is removed.

Refs #46