feat: add safer same-source consolidation preview

[AllenXiao95]

Second KISS Prevention slice for #46, following divergent-human protection in #52.

What changes

• ReviewIndex keeps two existing TranslationUnit fields on same-source coordinates: logical_key and optional context (schema remains v1; old sidecars remain compatible).
• Production same-source group reads overlay the current TM row onto each coordinate with raw fields only: current translation, origin, review state, formal flag, human-authored flag, and whether the value comes from TM.
• The Review UI shows a read-only coordinate table before consolidation with path/key, context, run translation, current translation, and authority.
• The UI explicitly says a unique plurality/majority is distribution evidence only, not proof of semantic correctness.

KISS boundaries

Deliberately not added:

• no new endpoint;
• no preview entity/state machine;
• no confirmation token or override mode;
• no new JS asset or additional function wrapper;
• no mutation logic derived from preview fields;
• no intentional_variant persistence yet.

The backend only exposes current raw state. Distribution counts and human-authority labels are derived in the existing Review UI from the returned member rows.

Regression coverage

• ReviewIndex group members carry logical key/context without changing qa-report.json;
• current TM edits are reflected in same-source preview while the immutable run translation remains visible;
• human/formal/review-state authority fields are surfaced after an explicit human commit;
• product Dashboard contains the safer-preview UI and warning copy;
• fix: fail closed on divergent human same-source unify #52 divergent-human fail-closed tests remain in place.

Refs #46