feat(server): W4-A integration endpoints and contract gaps

- POST /acquisition-plans: manual submit via download.plan -> download.submit
  (same authorization/audit/idempotency path as the agent), slotId or entityId
- read-only /media-assets, /asset-locations, /asset-unit-coverage, /path-bindings,
  /reconcile-runs, /server-mappings, /artifacts, GET /title-aliases/{id};
  unimplemented write endpoints removed from api.ts; registry test now checks both directions
- candidate evaluation upsert per (slot, source_release) + migration 0022 dedupe/unique index
- organization records expose downloadTaskId (+ list filter); inventory adds
  subscribed/candidateReasons; feed sources expose derived possibleGap
- GET /events?after=&limit= JSON replay page for API key callers (same sse_event table)
- preference tag revision history from audit_event; subscriptions/identities/aliases
  lists carry mediaEntityTitle; subscription q/mediaKind search; slot subscriptionId
  filter + currentAsset summary; policy preview samples carry title/reasons
- DecisionSummary, IdentityRevisionList, ReleaseIdentityResult, PolicyPreviewSummary exported from contracts

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/sse.test.ts

@@ -39,3 +39,29 @@ describe("GET /api/v1/events", () => {
     await reader.cancel();
   });
 });
+
+describe("GET /api/v1/events JSON 补读", () => {
+  it("带 limit 返回 JSON 页,按 nextAfter 续读", async () => {
+    const { app, bus } = testApp();
+    for (let i = 0; i < 5; i++) bus.publishSync("t", { i });
+    const h = { Authorization: `Bearer ${DEV_KEY}` };
+    const r1 = await app.request("/api/v1/events?after=1&limit=2", { headers: h });
+    expect(r1.headers.get("content-type")).toContain("application/json");
+    const b1 = (await r1.json()) as { data: { items: { seq: number }[]; nextAfter: number; hasMore: boolean } };
+    expect(b1.data.items.map((e) => e.seq)).toEqual([2, 3]);
+    expect(b1.data).toMatchObject({ nextAfter: 3, hasMore: true });
+    const r2 = await app.request(`/api/v1/events?after=${b1.data.nextAfter}&limit=10`, { headers: h });
+    const b2 = (await r2.json()) as { data: { items: { seq: number }[]; hasMore: boolean; latestSeq: number } };
+    expect(b2.data.items.map((e) => e.seq)).toEqual([4, 5]);
+    expect(b2.data).toMatchObject({ hasMore: false, latestSeq: 5 });
+  });
+
+  it("Accept: application/json 也走 JSON;非法 limit 400", async () => {
+    const { app, bus } = testApp();
+    bus.publishSync("a", 1);
+    const h = { Authorization: `Bearer ${DEV_KEY}` };
+    const r = await app.request("/api/v1/events", { headers: { ...h, Accept: "application/json" } });
+    expect(((await r.json()) as { data: { items: unknown[] } }).data.items).toHaveLength(1);
+    expect((await app.request("/api/v1/events?limit=0", { headers: h })).status).toBe(400);
+  });
+});