feat: add safe sprint rollback workflows

[numnx]

What changed

• Added first-class rollback sprint lineage, persistence, API contracts, and conservative safety assessment.
• Added a deterministic automatic path that proves the latest isolated merge, reverts it in a detached worktree, pushes a dedicated rollback branch, and uses no provider invocation.
• Added automatic fallback to an agent-assisted rollback when later work exists, history is ambiguous, the revert conflicts, or the user provides partial rollback instructions.
• Enforced the remote pull-request boundary for every rollback and prevented sprint completion until the Git host reports the rollback PR merged.
• Added an accessible rollback dialog plus distinct orange rollback styling and badges in both sprint gallery and ledger views.
• Updated canonical architecture/operator documentation and the published docs registry.

Why

Integrated sprint work needs an auditable reversal path that preserves Git history and later compatible work. This design keeps safe isolated reversions deterministic while routing ambiguous or partial removals through the normal agent, QA, Git, and CI pipeline.

Validation

• pnpm run ci — passed
  • Backend: 435 files, 5,478 tests passed, 7 skipped
  • Coverage: 82.61% statements, 72.35% branches, 83.76% functions, 83.86% lines
  • Dashboard: 241 files, 2,149 tests passed, 2 skipped
  • Audit, strict typecheck, quality guardrails, and production build passed
• Post-review focused route/modal tests: 6 passed
• Post-review pnpm run lint, pnpm run build, and git diff --check passed
• Live dashboard smoke: /health UP, /ready READY, and /sprints returned 200 on port 4444

Dashboard evidence

The rollback dialog and both rollback card treatments are covered by component, visual, and accessibility tests. A live screenshot is intentionally not attached because the local dashboard contains private project metadata.

Risk and rollback

• Database changes are additive columns/indexes with safe defaults for existing standard sprints.
• Automatic rollback mutates only a new remote rollback branch after an explicit user request; it never rewrites the source branch, default branch, or visible checkout.
• Reverting this PR removes the feature. Existing rollback metadata remains harmless additive data if application rollback is required.