feat(pubs): filter the candidate queue and retract accepted papers

[JamesKane]

Two curator tools for the publication-candidate review screen, which had grown a backlog too long to page through (5,629 rejected / 564 pending in the dev DB).

1. Queue filters

du_db::publication::list_candidates now takes a CandidateFilter { status, q, sort }:

• Search — case-insensitive substring over title, journal, DOI and OpenAlex id. LIKE metacharacters are escaped, so searching 100% matches a literal %. The count(*) is filtered too, so the pager doesn't advertise phantom pages.
• Sort — newest found (default) / oldest found / publication date / title A–Z.

The three controls sit in one #pc-filters box and each hx-includes the whole box, so status + search + sort compose (the house pattern from the haplogroups curator page). None of them sends page, so changing a filter lands back on page 1.

Sanity check against the dev DB: "ancient" narrows the 564 pending to 80.

2. Move an accepted paper back to rejected

An accepted candidate's panel gains a Move back to rejected form, backed by retract_candidate.

The judgment call worth a look in review: accepting promotes the candidate into pubs.publication, and promote_candidate may have reused a paper the curators already owned rather than creating one. So deleting the paper is opt-in rather than automatic:

• The candidate always flips back to rejected.
• A checkbox ("also remove the promoted paper") deletes it — but only when nothing references it.
• When samples or studies are attached, the checkbox is replaced by a note saying the paper stays and how many attachments there are. A ticked box in a racing request is refused server-side too, not just hidden in the UI.

The panel also now links the paper an accept produced (#42 → /references?query=…).

Verification

• cargo test -p du-db --test publication_candidate — 4 pass, including new queue_search_and_sort (all four searched fields, escaped %, filtered count, both new sorts) and retract_moves_accepted_back_to_rejected (keep-paper, delete-paper, refuse-delete-when-attached).
• cargo test -p du-web --bins -- --test-threads=1 — 69 pass, including 4 new template-render tests and the locale-parity test covering the new pc.* keys in en/es/fr.

No live browser pass: local login is OAuth-only, so the HTMX wiring is covered by render assertions (hx-include="#pc-filters" on all four elements, action=retract, delete_publication) rather than by clicking through it.

No migration; no API or job changes.

🤖 Generated with Claude Code