Add explicit paging and deletion policy for durable review history

[lynnswap]

Parent: #96
Related: #102

Contract

Durable history is not an unbounded eager in-memory collection. The database retains completed reviews until the user explicitly deletes them; the observable window always contains active reviews plus a bounded recent terminal page and can page older rows.

Acceptance criteria

• Initial memory window contains all nonterminal reviews plus the newest 100 terminal reviews.
• Paging older reviews preserves stable identity, manual order, selection, and current log projections.
• Every loaded job has fresh v0.6.2-compatible effective logEntries; no selected-only stale public surface.
• Deletion is offered only for terminal reviews and requires confirmation.
• Deleting a selected terminal review clears selection after commit.
• Active review deletion is rejected without implicit cancellation.
• Deletion cascades attempts, logs, and receipts and removes an empty workspace row in one transaction.
• MCP has no deletion capability in the published recovery contract.
• Database size, hydration memory, paging latency, and observer behavior are tested with a large synthetic history.

[lynnswap]

Paging semantics are fixed: initial terminal membership is the durable manual-order top 100 (default insertion order is recency) plus all active/selected IDs. The loaded-ID set only grows. Paging independently scans immutable (terminalAt, reviewID) recency order, skips already-loaded IDs, and advances its cursor only after a replacement observation publishes one complete snapshot. New terminals and manual reorder never evict loaded/selected rows or move the cursor.