feat(server): W4-A integration endpoints and contract gaps

- POST /acquisition-plans: manual submit via download.plan -> download.submit
  (same authorization/audit/idempotency path as the agent), slotId or entityId
- read-only /media-assets, /asset-locations, /asset-unit-coverage, /path-bindings,
  /reconcile-runs, /server-mappings, /artifacts, GET /title-aliases/{id};
  unimplemented write endpoints removed from api.ts; registry test now checks both directions
- candidate evaluation upsert per (slot, source_release) + migration 0022 dedupe/unique index
- organization records expose downloadTaskId (+ list filter); inventory adds
  subscribed/candidateReasons; feed sources expose derived possibleGap
- GET /events?after=&limit= JSON replay page for API key callers (same sse_event table)
- preference tag revision history from audit_event; subscriptions/identities/aliases
  lists carry mediaEntityTitle; subscription q/mediaKind search; slot subscriptionId
  filter + currentAsset summary; policy preview samples carry title/reasons
- DecisionSummary, IdentityRevisionList, ReleaseIdentityResult, PolicyPreviewSummary exported from contracts

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/sources-identity/ingest.test.ts

@@ -138,6 +138,15 @@ describe.skipIf(!up)("ingestFeed", () => {
       at: new Date(),
     });
     expect(route).toMatchObject({ task: "snapshotSite", input: { siteId, kind: "backfill", maxPages: 3 } });
+    // 响应派生字段 possibleGap;下一次衔接上的抓取后清空
+    const got = (await (await h.req(`/feed-sources/${f.id}`)).json()) as {
+      data: { possibleGap: { backfillQueued: boolean } | null };
+    };
+    expect(got.data.possibleGap).toMatchObject({ backfillQueued: true });
+    s.setItems([item("gap-9", "900209", "C.2020.1080p-X"), item("gap-10", "900210", "D.2020.1080p-X")]);
+    await ingestFeed(h.rt, f.id);
+    const after = (await (await h.req(`/feed-sources/${f.id}`)).json()) as { data: { possibleGap: unknown } };
+    expect(after.data.possibleGap).toBeNull();
   });
 
   it("登录失效(403):账号标失效 + 待处理,不重试", async () => {