Add decisions audit log for future move/delete tool

Captures every review action (keeper, redundant, skip, unreview, auto-resolve,
rescan-restore) with sha256 at decision time so a downstream tool can detect
stale decisions before touching disk.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/main.py

@@ -411,6 +411,7 @@ def decide(group_id: int, body: DecideBody):
         )
         status = "keeper" if is_k else "redundant"
         cur.execute("UPDATE files SET status=? WHERE id=?", (status, fid))
+        sc.log_decision(cur, fid, group_id, status, "manual")
 
     cur.execute("UPDATE duplicate_groups SET reviewed=1 WHERE id=?", (group_id,))
     con.commit()
@@ -425,6 +426,9 @@ def skip_group(group_id: int):
     cur.execute("SELECT id FROM duplicate_groups WHERE id=?", (group_id,))
     if not cur.fetchone():
         raise HTTPException(404, "Group not found")
+    cur.execute("SELECT file_id FROM duplicate_members WHERE group_id=?", (group_id,))
+    for r in cur.fetchall():
+        sc.log_decision(cur, r["file_id"], group_id, "skip", "manual")
     cur.execute("UPDATE duplicate_groups SET reviewed=1 WHERE id=?", (group_id,))
     con.commit()
     con.close()
@@ -445,6 +449,7 @@ def keep_all(group_id: int):
             (group_id, r["file_id"]),
         )
         cur.execute("UPDATE files SET status='keeper' WHERE id=?", (r["file_id"],))
+        sc.log_decision(cur, r["file_id"], group_id, "keeper", "keep-all")
     cur.execute("UPDATE duplicate_groups SET reviewed=1 WHERE id=?", (group_id,))
     con.commit()
     con.close()
@@ -465,6 +470,7 @@ def unreview_group(group_id: int):
             (group_id, r["file_id"]),
         )
         cur.execute("UPDATE files SET status='pending' WHERE id=?", (r["file_id"],))
+        sc.log_decision(cur, r["file_id"], group_id, "unreview", "manual")
     cur.execute("UPDATE duplicate_groups SET reviewed=0 WHERE id=?", (group_id,))
     con.commit()
     con.close()
@@ -504,6 +510,11 @@ def auto_resolve_exact():
                 "UPDATE files SET status=? WHERE id=?",
                 ("keeper" if is_k else "redundant", m["id"]),
             )
+            sc.log_decision(
+                cur, m["id"], gid,
+                "keeper" if is_k else "redundant",
+                "auto-resolve-exact",
+            )
         cur.execute("UPDATE duplicate_groups SET reviewed=1 WHERE id=?", (gid,))
         resolved += 1