v0.7.2-beta: ROA Planner / ROA Preflight

[DeepZone]

Motivation

• Introduce a read-only ROA Planner / ROA Preflight so operators can evaluate planned prefix+origin_as (+ optional max_length) against RPKI data and get explainable suggestions without any writes.
• Preserve the existing security model: RouteForge must not create, modify or delete ROAs, RIPE DB objects, or router configuration.
• Integrate the new check into existing workflows (reports, Change Cases, audit) so suggestions become part of the decision trail.

Description

• Backend: added RoaPlannerService (backend/app/services/roa_planner_service.py) which uses RipeStatClient to evaluate matching/conflicting ROAs, compute planned_validation_state, flag max_length risks and produce suggested_roa, matching_roas, conflicting_roas, recommendations and source_diagnostics.
• API: new endpoint POST /api/check/roa-preflight implemented in backend/app/api/routes_checks.py with request schema RoaPreflightCheckRequest in backend/app/schemas.py, authorization using the existing operator/admin role guard, reuse of existing check/report persistence and change-case attachment logic, and audit event roa_preflight_checked.
• Frontend: added API helper runRoaPreflightCheck in frontend/src/api.ts, a ROA Planner UI form frontend/src/components/RoaPlannerForm.tsx, navigation entry in frontend/src/components/Layout.tsx, App routing in frontend/src/App.tsx, and Change Case integration to run ROA preflight from case details.
• Misc: bumped visible version to v0.7.2-beta and updated README.md, ROADMAP.md and RELEASE_NOTES.md to reflect the release and feature.

Testing

• Backend unit/integration: ran cd backend && pytest -q; test suite passed (99 passed in this environment) and new tests for ROA preflight (role checks, viewer forbidden, suggested ROA, invalid max_length, change-case 404 and attachment, and audit emission) were added to backend/tests/test_api_smoke.py.
• Frontend build: ran cd frontend && npm run build; the production build completed successfully (vite build succeeded, with a non-blocking npm env warning).
• Report/reporting and persistence reuse were validated by executing the new endpoint through the same report rendering/persistence flow used by existing checks.

---

Codex Task