feat(T5): editor web mapare operatii (hibrid + fuzzy + on-demand needs_mapping)

T5 reinterpretat: nu import DBF, ci editor web al maparii operatie ROAAUTO ->
cod RAR, cu fuzzy lookup si validare de catre utilizator.

- Contract hibrid: item prestatie accepta cod_prestatie (RAR direct, back-compat)
  SAU cod_op_service+denumire (mapat de gateway prin operations_mapping).
- Ingestie: op intern necunoscut -> submission needs_mapping (nu pleaca la RAR);
  codul rezolvat se scrie inapoi in payload_json -> payload builder + worker neatinse.
- Editor HTMX (_mapari.html + GET /_fragments/mapari, POST /mapari): listeaza
  op-urile nemapate, fuzzy preselecteaza codul RAR, save -> re-rezolvare automata
  (queued / needs_data).
- Fuzzy: rapidfuzz.token_sort_ratio pe denumire normalizata (fara diacritice).
- Nomenclator: seed fallback 18 coduri la boot (offline) + refresh live din worker.
- Cont default id=1 cat timp auth API-key (CORE) nu exista (account_id NULL).
- Endpointuri API: GET /v1/mapari/pending, POST /v1/mapari (respinge cod inexistent).
- 15 teste noi (tests/test_mapping.py); 69 pass total.
- Contract actualizat (docs/api-rar-contract.md), rapidfuzz==3.14.5 in requirements.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/schema.sql

@@ -14,6 +14,10 @@ CREATE TABLE IF NOT EXISTS accounts (
     cui         TEXT,
     created_at  TEXT NOT NULL DEFAULT (datetime('now'))
 );
+-- Cont implicit (id=1): auth API-key (CORE) inca neimplementat, deci ingestiile vin
+-- cu account_id NULL. Le atribuim contului default ca FK + UNIQUE(account_id,...) din
+-- operations_mapping sa fie valide; cand auth livreaza, account_id real va curge natural.
+INSERT OR IGNORE INTO accounts (id, name) VALUES (1, 'default');
 
 -- Chei API per cont (separate de creds RAR). Stocam doar hash-ul.
 CREATE TABLE IF NOT EXISTS api_keys (