feat(5.19): auto-send toggle per cont + tinere manuala randuri (held)

Comutator accounts.auto_send_enabled per cont: Auto OFF (default) tine randurile
la ingestie (submissions.held=1), worker-ul (claim_one AND held=0) le sare pana la
eliberare umana (per rand/bulk/auto-release OFF->ON). Snapshot held prin chokepoint
unic held_for_account pe toate caile de ingestie (API, import, reresolve, reactivare).

- schema/migrare: coloana held + index partial idx_submissions_held; auto_send_enabled
- API: echo onest held+motiv (US-010), ruta /prezentari/{id}/trimite-acum
- web: toggle header, modal confirmare tipata, buton Trimite per rand + Trimite toate,
  banner coada tinuta imbatranita (L.142), contor "In asteptare (manual)"
- worker: expire_held (US-008, inchide gaura retentie PII), metrics held gauges
- ops: tools/carantina_held + runbook rollback (R4)

Nota review (/code-review high): re-snapshot held lipseste pe caile repune/corectie
(requeue_submission, post_corectie, bulk-fix) — de aliniat separat cu create_prezentari.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/worker/__main__.py

@@ -142,6 +142,30 @@ def purge_expired(conn) -> dict[str, int]:
     }
 
 
+def expire_held(conn, settings: Settings) -> int:
+    """Expira randurile tinute manual (`queued AND held=1`) mai vechi de `held_retention_days`.
+
+    PRD 5.19 US-008 (inchide gaura GDPR/L.142): un `queued held=1` nu e nici `sent` nici
+    blocat -> altfel NU primeste `purge_after` -> PII criptat ar sta la nesfarsit.
+    Le trece la `error`/`TINUT_EXPIRAT` (terminal) si seteaza `purge_after` DIRECT la
+    momentul expirarii (NU lasa retentia de 30z a randurilor blocate sa se adauge; altfel
+    viata reala = 90 + 30 = 120 zile, nu 90). Randul devine imediat purjabil de
+    `purge_expired` (purge_after < now) la urmatorul ciclu.
+
+    Intoarce numarul de randuri expirate.
+    """
+    # Numar de zile validat (int) — construim string-ul '-N days' fara input extern.
+    days = int(settings.held_retention_days)
+    cutoff = f"-{days} days"
+    cur = conn.execute(
+        "UPDATE submissions SET status='error', rar_error='TINUT_EXPIRAT', "
+        "purge_after=datetime('now'), sending_since=NULL, updated_at=datetime('now') "
+        "WHERE status='queued' AND held=1 AND created_at < datetime('now', ?)",
+        (cutoff,),
+    )
+    return cur.rowcount
+
+
 def requeue_with_backoff(conn, settings: Settings, submission_id: int, *, reason: str) -> None:
     """Re-pune randul in coada cu retry++ si next_attempt_at = now + backoff."""
     row = conn.execute("SELECT retry_count FROM submissions WHERE id=?", (submission_id,)).fetchone()
@@ -171,6 +195,10 @@ def claim_one(conn) -> dict | None:
             "SELECT s.id, s.account_id, s.payload_json, s.rar_creds_enc, s.rar_env "
             "FROM submissions s LEFT JOIN accounts a ON a.id = s.account_id "
             "WHERE s.status='queued' "
+            # PRD 5.19 US-003: randurile tinute manual (held=1) NU se revendica —
+            # asteapta eliberarea umana (manual/auto). Se aplica DOAR la claim din
+            # 'queued'; randurile deja 'sending' (orfani/reconciliere) sunt neafectate.
+            "AND s.held = 0 "
             "AND (s.next_attempt_at IS NULL OR s.next_attempt_at <= ?) "
             # Gate pe stare de cont: doar 'active' trimite. Derivam defensiv din `active`
             # cand `status` lipseste (DB veche pre-migrare), pastrand active=1 <=> 'active'.
@@ -533,6 +561,13 @@ def run() -> int:
             # Purjare periodica (odata pe ora) — NU mai frecvent.
             now_ts = time.time()
             if now_ts - _last_purge_time >= _PURGE_INTERVAL_S:
+                # Expira intai randurile tinute imbatranite (US-008), apoi purjeaza:
+                # un rand expirat cu purge_after=now devine imediat purjabil in acelasi ciclu.
+                expired = expire_held(conn, settings)
+                if expired:
+                    _wlog(conn, "held_expirat",
+                          f"{expired} randuri tinute expirate (>{settings.held_retention_days}z) -> error/TINUT_EXPIRAT",
+                          nivel="WARNING", context={"expirate": expired})
                 stats = purge_expired(conn)
                 if stats["submissions_purged"] or stats["batches_purged"] or stats["events_purged"]:
                     print(