Add evidence-bound cloud review decisions

[seonghobae]

What changed

• add an evidence-bound review_fingerprint beside the existing metadata fingerprint
• persist append-only, integrity-bound, read-only approve/hold decisions without paths or metadata values
• rebuild the plan before review and copy, and serialize review writes with review-gated copies
• let the UI record approval or hold after displaying embedded metadata evidence
• keep filename-derived dates, planner blockers, provider checks, path safety, receipts, and source retention mandatory

Why

Candidates with incomplete or sensitive metadata need an explicit operator decision. The prior gate
correctly blocked every review-required candidate but had no safe way to record that the displayed
metadata had actually been inspected.

Safety impact

Approval clears only review-required. It cannot satisfy the embedded high-confidence production
date requirement, cannot bypass destination or path blockers, and automatically expires whenever
the candidate or displayed review evidence changes. The source deletion API remains absent.

Validation

• npm run check — passed, 0 errors and 0 warnings
• npm test — passed, 5 files / 18 tests
• git diff --check — passed
• local cargo check --all-targets -j1 did not reach project compilation because macOS killed
  rustc while compiling serde_with with SIGKILL under memory pressure; GitHub Test/Release should
  provide the Rust compilation result