feat(5.6): observabilitate + jurnal aplicatie + lifecycle trimiteri blocate

Implementeaza PRD 5.6 complet (14 stories, TDD). Doua axe:

Lifecycle trimiteri blocate (Val A):
- submissions_admin.py: sterge/repune scoped (404 cross-account inaintea lui 409 stare)
- reactivare dedup peste `error` cu CAS (WHERE id=? AND status='error'), creds noi in
  submissions + accounts.rar_creds_enc; worker invalideaza sesiunea RAR la creds proaspete
  (JWT 30h vechi nu mai trimite cu parola gresita); camp aditiv `reactivated:true`
- retentie randuri blocate 30z; purge_expired exclude queued/sending; purge_after curatat
  la reactivare/requeue
- API DELETE /v1/prezentari/{id} + /repune (200+JSON); UI butoane + bulk + banner actionabil

Observabilitate:
- app/observ.py log_event: dublu canal app_events (DB) + RotatingFileHandler per-proces,
  redactare creds/PII la scriere (redact_pii/vin_partial)
- request_id middleware + X-Request-ID pe toate raspunsurile
- handler global excepții -> 500 envelope 6-chei + request_id (traceback doar in jurnal)
- audit cerere API (api_prezentari/api_auth_esuat) + audit worker (rar_login/tranzitii)
- tab "Jurnal" filtrabil scoped (non-admin doar contul sau); retentie jurnal 90z
- rar_error expus in GET /v1/prezentari/{id} (recovery observabil)

pytest -q: 741 passed, 0 failed. Docs: PRD raport VERIFY, contract endpointuri noi, ROADMAP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/config.py

@@ -22,6 +22,21 @@ class Settings(BaseSettings):
     # --- Bază de date ---
     db_path: Path = ROOT / "data" / "autopass.db"
 
+    # --- Observabilitate / jurnal aplicatie (PRD 5.6) ---
+    # Nivel minim al evenimentelor scrise in app_events + log text. Sub el, evenimentul
+    # e ignorat (best-effort). DEBUG|INFO|WARNING|ERROR|CRITICAL.
+    log_level: str = "INFO"
+    # Retentie jurnal (app_events) — aliniat cu submissions/import_batches (decizie §5).
+    log_retention_days: int = 90
+    # Director pentru log-ul text rotativ (RotatingFileHandler in aplicatie, decizie §5).
+    # Fisier per-proces (app-api.log / app-worker.log) — rotatia nu e multiproces-safe.
+    log_dir: Path = ROOT / ".run"
+    log_file_max_bytes: int = 5_000_000
+    log_file_backup_count: int = 5
+    # Retentie randuri blocate (error/needs_data/needs_mapping). Mai scurt decat 90z
+    # ale `sent` — un blocat n-are valoare de audit (decizie §5).
+    blocked_retention_days: int = 30
+
     # --- Securitate (CORE) ---
     # Enforcement auth API-key pe /v1/* protejat. False (dev/test): fara cheie ->
     # cont implicit id=1. True (prod): fara cheie valida -> 401. O cheie PREZENTA