#169: Persist passive blocker projections

[justsml]

Stacked on #163 / PR #176.

Refs #169

Scope

• Replace process-local blocker storage with a relational repository in product runtime while preserving an explicit in-memory test repository.
• Add a SQLite/PostgreSQL-compatible blocker migration and include the table in PostgreSQL JSON-column normalization.
• Atomically upsert normalized passive blockers by a structured project/target/task/reason identity so repeated reports update instead of duplicate.
• Reject cross-project thread, target, and task attribution and prevent a conflicting dedupe key from re-attributing an existing blocker.
• Link each blocker to the latest passive summary Artifact and bounded raw source Artifact IDs.
• Project all ten normalized passive blocker classes with review-only queue_action labels.
• Render the canonical blocker queue after reload with complete, uncapped totals and a bounded five-record view, target/task links, and Artifact IDs; next actions remain inert labels.
• Integrate blocker persistence into the existing passive-auth report path without running, retrying, escalating, requesting approval, or scheduling target work.
• Document the durability and passive-only action contract.

Validation

• pnpm vitest run --config vitest.integration.config.ts tests/integration/db-client.test.ts tests/integration/passive-auth-blockers.test.ts tests/integration/discovery-artifact-normalizer.test.ts tests/integration/blockers.test.ts tests/integration/research-cockpit.test.ts (5 files, 29 tests passed)
• Cross-project attribution and delimiter-collision regressions pass.
• A 101-record regression proves totals and thread filtering are not truncated by the UI page size.
• pnpm typecheck
• New passive blocker files and touched recon exports pass targeted Biome checks.
• git diff --check

Human review gate

This remains a draft because #169 explicitly requires human review of safe-action wording and authorization/network implications. No action in this PR requests approval, changes scope, retries work, or contacts a target.

[justsml]

Council of Dans review: repair/defer. Highest-priority gate: Bound active-blocker reads, preserve the explicit human wording/network gate, and verify migration/dedupe behavior on the consolidated passive parent. Feature flags are not a substitute for authority, evidence-integrity, or durability fixes; use typed modes only where they provide a real rollout boundary.