fix: make protected answer batches atomic

[Joncallim]

Source Issue

Issue: #179

What changed

Protected clarification forms now use the existing fixed-authority answer routine inside one PostgreSQL transaction. The route validates the complete open-question batch before calling that writer, queues the answers continuation after commit, and only then attempts the progress event as best-effort.

This closes PR #198 findings PRRT_kwDOS9dWe86VJqjv and PRRT_kwDOS9dWe86VJqj4 without adding a database routine, role, migration, or plaintext sink. Legacy encrypted clarification handling is unchanged.

Why it matters

A later invalid answer can no longer leave the first answers committed, and a temporary task-event publisher outage can no longer strand a successfully committed answer batch before the answers worker is queued.

Base and scope

• Base branch: codex/pr198-f2-s4-clarification-inventory
• Exact base SHA: 10c2154b33f5d4fe55597be54a47eeefa3c609d4
• Exact head SHA: 9340ccc01af671f1b02effd683a7d8f74078d267
• Files: question route, protected history-reader boundary, focused API test, focused real-PostgreSQL test

Validation

• Question-route focus: 11 passed
• Full API route suite: 207 passed
• Unit suite: 1,736 passed; 16 service-gated tests excluded/skipped by the repository command
• Changed-file ESLint: passed
• TypeScript: passed
• Production build: passed
• git diff --check: passed
• Hosted Web CI run 30559990552, job 90930218008: passed, including the mandatory 16/16 S4 PostgreSQL suite
• Hosted Contract run 30559990683, job 90930219120: passed
• GitGuardian: passed

Stack

This is the first child in the required F5 → F4 → F3 progressive merge order. It remains draft and must not be merged directly.