feat(5.19): auto-send toggle per cont + tinere manuala randuri (held)

Comutator accounts.auto_send_enabled per cont: Auto OFF (default) tine randurile
la ingestie (submissions.held=1), worker-ul (claim_one AND held=0) le sare pana la
eliberare umana (per rand/bulk/auto-release OFF->ON). Snapshot held prin chokepoint
unic held_for_account pe toate caile de ingestie (API, import, reresolve, reactivare).

- schema/migrare: coloana held + index partial idx_submissions_held; auto_send_enabled
- API: echo onest held+motiv (US-010), ruta /prezentari/{id}/trimite-acum
- web: toggle header, modal confirmare tipata, buton Trimite per rand + Trimite toate,
  banner coada tinuta imbatranita (L.142), contor "In asteptare (manual)"
- worker: expire_held (US-008, inchide gaura retentie PII), metrics held gauges
- ops: tools/carantina_held + runbook rollback (R4)

Nota review (/code-review high): re-snapshot held lipseste pe caile repune/corectie
(requeue_submission, post_corectie, bulk-fix) — de aliniat separat cu create_prezentari.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_carantina_held.py

@@ -0,0 +1,99 @@
+"""Teste PRD 5.19 R4 — tools/carantina_held.py (atenuare hazard de rollback).
+
+Carantineaza randurile `queued AND held=1` (-> `error`/`ROLLBACK_QUARANTINE`)
+ca sa nu fie trimise de un worker fara filtrul `AND held=0` dupa un revert.
+`--dry-run` doar numara, fara sa scrie.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+
+import pytest
+
+
+@pytest.fixture()
+def env(monkeypatch):
+    tmp = tempfile.mkdtemp()
+    monkeypatch.setenv("AUTOPASS_DB_PATH", os.path.join(tmp, "t.db"))
+    from app.config import get_settings
+    get_settings.cache_clear()
+    from app.db import get_connection, init_db
+    init_db()
+    conn = get_connection()
+    yield conn
+    conn.close()
+    get_settings.cache_clear()
+
+
+_CONTENT = {
+    "vin": "WVWZZZ1KZAW000123", "nr_inmatriculare": "B999TST",
+    "data_prestatie": "2026-06-15", "odometru_final": "123456",
+    "prestatii": [{"cod_prestatie": "OE-1"}],
+}
+
+
+def _insert(conn, status="queued", held=0):
+    cur = conn.execute(
+        "INSERT INTO submissions (idempotency_key, status, payload_json, account_id, held) "
+        "VALUES (?, ?, ?, ?, ?)",
+        (f"key-{os.urandom(4).hex()}", status, json.dumps(_CONTENT), 1, held),
+    )
+    return int(cur.lastrowid)
+
+
+def _row(conn, sid):
+    return conn.execute("SELECT * FROM submissions WHERE id=?", (sid,)).fetchone()
+
+
+def _run(argv):
+    from tools.carantina_held import main
+    return main(argv)
+
+
+def test_carantineaza_rand_tinut(env, capsys):
+    conn = env
+    sid = _insert(conn, status="queued", held=1)
+    rc = _run([])
+    out = capsys.readouterr().out
+    assert rc == 0
+    assert "1 randuri carantinate" in out
+    r = _row(conn, sid)
+    assert r["status"] == "error"
+    assert r["rar_error"] == "ROLLBACK_QUARANTINE"
+
+
+def test_dry_run_nu_modifica(env, capsys):
+    conn = env
+    sid = _insert(conn, status="queued", held=1)
+    rc = _run(["--dry-run"])
+    out = capsys.readouterr().out
+    assert rc == 0
+    assert "dry-run" in out
+    assert "1 randuri" in out
+    r = _row(conn, sid)
+    assert r["status"] == "queued"  # neschimbat
+    assert r["rar_error"] is None
+
+
+def test_nu_atinge_randuri_ne_tinute_sau_ne_queued(env, capsys):
+    conn = env
+    sid_libera = _insert(conn, status="queued", held=0)
+    sid_sent = _insert(conn, status="sent", held=1)  # held dar deja plecat
+    sid_tinuta = _insert(conn, status="queued", held=1)
+    rc = _run([])
+    capsys.readouterr()
+    assert rc == 0
+    assert _row(conn, sid_libera)["status"] == "queued"
+    assert _row(conn, sid_sent)["status"] == "sent"
+    assert _row(conn, sid_tinuta)["status"] == "error"
+
+
+def test_fara_randuri_tinute(env, capsys):
+    _insert(env, status="queued", held=0)
+    rc = _run([])
+    out = capsys.readouterr().out
+    assert rc == 0
+    assert "Niciun rand tinut" in out