feat(5.19): auto-send toggle per cont + tinere manuala randuri (held)

Comutator accounts.auto_send_enabled per cont: Auto OFF (default) tine randurile
la ingestie (submissions.held=1), worker-ul (claim_one AND held=0) le sare pana la
eliberare umana (per rand/bulk/auto-release OFF->ON). Snapshot held prin chokepoint
unic held_for_account pe toate caile de ingestie (API, import, reresolve, reactivare).

- schema/migrare: coloana held + index partial idx_submissions_held; auto_send_enabled
- API: echo onest held+motiv (US-010), ruta /prezentari/{id}/trimite-acum
- web: toggle header, modal confirmare tipata, buton Trimite per rand + Trimite toate,
  banner coada tinuta imbatranita (L.142), contor "In asteptare (manual)"
- worker: expire_held (US-008, inchide gaura retentie PII), metrics held gauges
- ops: tools/carantina_held + runbook rollback (R4)

Nota review (/code-review high): re-snapshot held lipseste pe caile repune/corectie
(requeue_submission, post_corectie, bulk-fix) — de aliniat separat cu create_prezentari.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/config.py

@@ -35,6 +35,12 @@ class Settings(BaseSettings):
     # Retentie randuri blocate (error/needs_data/needs_mapping). Mai scurt decat 90z
     # ale `sent` — un blocat n-are valoare de audit.
     blocked_retention_days: int = 30
+    # Prag zile (PRD 5.19 US-007): randurile tinute manual (`queued AND held=1`) mai vechi de
+    # atat declanseaza bannerul de avertizare L.142 (declararea are termen legal).
+    held_warn_days: int = 7
+    # Retentie randuri tinute manual (PRD 5.19 US-008): un `queued AND held=1` mai vechi de atat
+    # expira la `error` (`TINUT_EXPIRAT`) + purge_after direct. Aliniat retentiei `sent` (90z).
+    held_retention_days: int = 90
 
     # --- Securitate ---
     # Enforcement auth API-key pe /v1/* protejat. False (dev/test): fara cheie ->