feat(5.19): auto-send toggle per cont + tinere manuala randuri (held)

Comutator accounts.auto_send_enabled per cont: Auto OFF (default) tine randurile
la ingestie (submissions.held=1), worker-ul (claim_one AND held=0) le sare pana la
eliberare umana (per rand/bulk/auto-release OFF->ON). Snapshot held prin chokepoint
unic held_for_account pe toate caile de ingestie (API, import, reresolve, reactivare).

- schema/migrare: coloana held + index partial idx_submissions_held; auto_send_enabled
- API: echo onest held+motiv (US-010), ruta /prezentari/{id}/trimite-acum
- web: toggle header, modal confirmare tipata, buton Trimite per rand + Trimite toate,
  banner coada tinuta imbatranita (L.142), contor "In asteptare (manual)"
- worker: expire_held (US-008, inchide gaura retentie PII), metrics held gauges
- ops: tools/carantina_held + runbook rollback (R4)

Nota review (/code-review high): re-snapshot held lipseste pe caile repune/corectie
(requeue_submission, post_corectie, bulk-fix) — de aliniat separat cu create_prezentari.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/schema.sql

@@ -33,6 +33,14 @@ CREATE TABLE IF NOT EXISTS accounts (
     -- 1 (respinge cererea fara enqueue). Override per-cerere via PrezentareRequest.on_unmapped_error.
     on_unmapped_error_default INTEGER NOT NULL DEFAULT 0
                        CHECK (on_unmapped_error_default IN (0, 1)),
+    -- Comutator Auto per cont (PRD 5.19 US-001). AL TREILEA `auto_send` din schema (R6):
+    -- DISTINCT de operations_mapping.auto_send si operation_text_rules.auto_send, care sunt
+    -- PER-OPERATIE. Acesta e PER-CONT si guverneaza DOAR: (a) valoarea implicita a lui
+    -- submissions.held la ingestie (held = 0 daca 1, altfel 1 — vezi accounts.held_for_account);
+    -- (b) eliberarea in bloc a randurilor tinute la comutarea OFF -> ON. NU e per-operatie si
+    -- NU intra in payload/idempotenta/RAR. Default 0 = Auto OFF (randuri noi tinute manual).
+    auto_send_enabled INTEGER NOT NULL DEFAULT 0
+                       CHECK (auto_send_enabled IN (0, 1)),
     -- Plan de cont (5.17). Tier de baza al contului (admin aloca manual via CLI set-tier).
     -- trial_until: daca != NULL si > now -> effective_tier() intoarce 'pro' (trial Pro activ).
     -- Cont nou primeste tier='free' + trial_until=now+30z via create_account.
@@ -110,13 +118,23 @@ CREATE TABLE IF NOT EXISTS submissions (
     purge_after      TEXT,                   -- sent + 90z (T16)
     batch_id         INTEGER,               -- import batch (T7; NULL = canal API)
     row_index        INTEGER,               -- rand in batch (T7; NULL = canal API)
+    -- Randuri tinute manual (PRD 5.19 US-001). rand `queued AND held=1` = "In asteptare
+    -- (manual)": tinut pana la eliberare umana (trimitere manuala per rand/bulk: held 1 -> 0).
+    -- Worker-ul (claim_one) ia doar `queued AND held=0`. held NU intra in payload/idempotenta
+    -- si NU pleaca la RAR — e pur control de coada (ca import_rows.reviewed). Snapshot la
+    -- ingestie din accounts.auto_send_enabled (vezi accounts.held_for_account).
+    held             INTEGER NOT NULL DEFAULT 0 CHECK (held IN (0, 1)),
     created_at       TEXT NOT NULL DEFAULT (datetime('now')),
     updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
 );
 
 CREATE INDEX IF NOT EXISTS idx_submissions_status ON submissions(status);
 CREATE INDEX IF NOT EXISTS idx_submissions_account_status ON submissions(account_id, status);
--- Nota: idx_submissions_batch se creeaza in _migrate (dupa ALTER care adauga batch_id pe DB veche).
+-- Nota: idx_submissions_batch si idx_submissions_held se creeaza in _migrate, NU aici. `init_db`
+-- ruleaza executescript(schema.sql) INAINTE de _migrate; pe un DB existent pre-`held`/`batch_id`
+-- coloana inca nu exista in momentul executarii schemei, deci un CREATE INDEX pe ea ar esua
+-- (no such column). Indexul partial `idx_submissions_held ON submissions(held) WHERE held=1`
+-- (PRD 5.19 US-001) traieste doar in _migrate, ca `idx_submissions_batch`.
 
 -- Mapare coloane fisier -> campuri canonice (retinuta per cont, semnatura coloane).
 CREATE TABLE IF NOT EXISTS column_mappings (