feat: persist review workbench decisions (#1)

Merge dcy-012 / REQ-020 / BAT-016 implementation after green CI.

docs/data-model.md

@@ -193,6 +193,20 @@
   - Backup artifacts and validation DB copies must not be committed to git.
   - Restore execution is not a persisted MCP operation and requires script/runbook approval controls.
 
+## Entity: ReviewDecision
+- Source of Truth: `review_decisions`
+- Purpose: 공통 review/workbench envelope for cross-transfer review rows, reconciliation targets, and uncategorized recommendation items.
+- Lifecycle: pending -> decided/held/needs_recheck/ignored -> pending release when operator clears hold/recheck.
+- Key Fields: `id`, `target_type`, `target_id`, `status`, `decision_type`, `reason_code`, `memo`, `operator`, `decided_at`, `review_after`, sanitized JSON `target_payload`, `created_at`, `updated_at`.
+- State Rules: decisions are non-destructive and do not rewrite accounting fields by themselves. Existing read contracts are preserved by attaching additive `review_status` / `review_decision` metadata. `target_payload` omits raw payloads, passwords, tokens, secrets, and source file paths.
+
+## Entity: ReconciliationSession
+- Source of Truth: `reconciliation_sessions`
+- Purpose: 계좌별/기준일별 잔액대조 session close/open state and difference evidence.
+- Lifecycle: open -> closed, with `needs_recheck`/`ignored` available for operator triage.
+- Key Fields: `id`, `account_id`, `basis_date`, `expected_balance`, `actual_balance`, `difference`, `status`, `closed_at`, `source_note`, `memo`, `operator`, `created_at`, `updated_at`.
+- State Rules: account/basis-date rows are upserted idempotently; close records `closed_at`; destructive delete/reset workflow is not exposed.
+
 ## Consistency Rules
 - Actual cashflow reports include only categories whose `cashflow_kind` represents actual income or expense according to report semantics.
 - Account movement summaries should be separate from actual household income/expense summaries.
@@ -202,6 +216,8 @@
 - DB corrections should be narrow and memo-tagged.
 - Dashboard/MCP asset and net-worth reports use a shared valuation helper: account-backed items from `accounts.last_balance` plus non-transaction items from `manual_assets`.
 - Net worth is asset buckets (`cash`, `investment`, `deposit`, `real_estate`, `other`) minus absolute `loan` liabilities; missing valuations are excluded and reported, never inferred from transactions.
+- Review workbench state is sourced from `review_decisions`; pending/held/recheck counts must not be inferred by overwriting raw transaction evidence.
+- Reconciliation operating state is sourced from `reconciliation_sessions`; last close time is the max closed session `closed_at`.
 
 ## Persistence Notes
 - Schema changes should be additive/idempotent unless a destructive migration is explicitly approved and backed up.
@@ -209,11 +225,12 @@
 - Validation DB copies should live outside the repository and should be selected explicitly via `JARCA_LEDGER_DB_PATH` when used.
 - Passwords for encrypted imports are runtime-only inputs and are not part of the persisted model.
 - Raw payloads may contain sensitive financial evidence and should not be committed to git.
+- ReviewDecision `target_payload` is sanitized to omit `raw_payload`, passwords, tokens, secrets, and file paths before persistence.
 
 ## Current Gaps / Planned Changes
 - Formal schema migration documentation should be added before larger DB changes.
 - Some UI workflows need final E2E verification against real rows.
-- Statement-unavailable account handling is tracked by REQ-003/BAT-003; future work may add a dedicated reconciliation workbench and persistent review-decision queue.
+- Statement-unavailable account handling is tracked by REQ-003/BAT-003; REQ-020/BAT-016 adds dedicated reconciliation sessions and persistent review-decision queue metadata.
 - BAT-009 implements manual asset CRUD mutation and month-end snapshot preview/close/correction service/MCP/dashboard workflow. Future work may add automatic market/real-estate valuation or scheduled month-end close.
 
 ## Change Log
@@ -223,3 +240,4 @@
 - 2026-06-29 KST: REQ-005/BAT-005 기준으로 `accounts.liquidity_bucket`, `last_balance` 기반 자산 유동성/부채/순자산 규칙 추가.
 - 2026-06-30 KST: REQ-009/REQ-010/BAT-008 기준으로 `manual_assets`, `asset_snapshots`, 권위 소스(`accounts.last_balance` + `manual_assets`), 순자산 산식/미평가 제외 정책 추가.
 - 2026-07-01 KST: REQ-011/REQ-012/BAT-009 기준으로 manual asset CRUD, snapshot preview/close, append-only correction metadata, latest-run read policy 추가.
+- 2026-07-08 KST: REQ-020/BAT-016 기준으로 `review_decisions`, `reconciliation_sessions`, review 상태값, payload 최소보관/마스킹 규칙, 운영 허브 집계 source-of-truth를 추가.