feat(5.19): auto-send toggle per cont + tinere manuala randuri (held)

Comutator accounts.auto_send_enabled per cont: Auto OFF (default) tine randurile
la ingestie (submissions.held=1), worker-ul (claim_one AND held=0) le sare pana la
eliberare umana (per rand/bulk/auto-release OFF->ON). Snapshot held prin chokepoint
unic held_for_account pe toate caile de ingestie (API, import, reresolve, reactivare).

- schema/migrare: coloana held + index partial idx_submissions_held; auto_send_enabled
- API: echo onest held+motiv (US-010), ruta /prezentari/{id}/trimite-acum
- web: toggle header, modal confirmare tipata, buton Trimite per rand + Trimite toate,
  banner coada tinuta imbatranita (L.142), contor "In asteptare (manual)"
- worker: expire_held (US-008, inchide gaura retentie PII), metrics held gauges
- ops: tools/carantina_held + runbook rollback (R4)

Nota review (/code-review high): re-snapshot held lipseste pe caile repune/corectie
(requeue_submission, post_corectie, bulk-fix) — de aliniat separat cu create_prezentari.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/models.py

@@ -109,6 +109,10 @@ class SubmissionResult(BaseModel):
     # RE-ACTIVAT (re-clasificat + creds actualizate) la resubmit. `deduped` pastreaza
     # semantica actuala (clientii vechi care testeaza `deduped` nu se sparg).
     reactivated: bool = False
+    # Ecou PUR de coada (PRD 5.19 US-010): True cand randul e `queued AND held=1`
+    # (tinut manual, cont Auto OFF) -> NU a plecat la RAR, asteapta eliberarea umana.
+    # NU influenteaza payload/idempotenta; onestitate fata de integratorul API (invariant 5.7).
+    held: bool = False
     # Mediul RAR tinta efectiv (ecou din DB / rezolvat la ingestie).
     rar_env: str = "test"
     # Raspuns ONEST pentru randuri blocate: orice status != 'queued' isi expune