PIR: Add optOutFormSubmittedDate to Web dashboard contract

[landomen]

Task/Issue URL: https://app.asana.com/1/137249556945/project/1209121419454298/task/1214253991604420?focus=true

Description

Implements the Android side of the cross-platform "opt-out submitted" unification design. Adds a new optOutFormSubmittedDate field to the per-match payload sent to the PIR Web dashboard so the Activity card can count submissions made by us, not broker acknowledgments.

• Persists optOutFormSubmittedDate on a new nullable column on OptOutJobRecordEntity (DB v16, destructive migration via existing fallback).
• Stamps the timestamp on first successful form submission and never overwrites on retries:
  • non-email brokers → set in JobRecordUpdater.updateOptOutRequested
  • email-confirming brokers → set in JobRecordUpdater.markOptOutAsWaitingForEmailConfirmation (the form-submission moment for that flow)
• Surfaces the field through DashboardExtractedProfileResult and PirWebMessageResponse.ScanResult (in seconds, like the sibling timestamps).
• Child brokers (broker.parent != null) inherit the most recent optOutFormSubmittedDate across any opt-out on the parent broker per design note [3]. Mirror sites copy the value from the parent broker's match.
• No backfill — existing records have null until their next form submission.

Steps to test this PR

Form submission stamping (non-email broker)

• Run an initial scan against a non-email-confirming broker, then trigger an opt-out for a found profile.
• Verify in the DB (pir_optout_job_record table) that optOutFormSubmittedDate and optOutRequestedDate are equal and non-null.
• Re-trigger the opt-out (forced retry) and confirm optOutFormSubmittedDate is unchanged while optOutRequestedDate updates.

Form submission stamping (email-confirming broker)

• Run an opt-out against an email-confirming broker.
• Verify optOutFormSubmittedDate is set as soon as the form is submitted (status = PENDING_EMAIL_CONFIRMATION), before email confirmation completes.
• Complete the email confirmation; verify optOutRequestedDate is set later than optOutFormSubmittedDate.

Web contract

• Open the PIR Web dashboard. In WebView devtools, inspect the initialScanStatus / maintenanceScanStatus response payloads and confirm each ScanResult includes optOutFormSubmittedDate (Unix seconds, nullable).

Child broker propagation

• With opt-outs run against a parent broker, verify that child broker matches in the dashboard payload carry the parent's most recent optOutFormSubmittedDate, even when the child profile doesn't strictly match the parent.

UI changes

N/A — native↔WebView contract change only; no native UI changes.

---

Note

Medium Risk
Adds a new persisted timestamp to the opt-out job record (Room DB v16) and threads it through scheduling and dashboard state into the WebView JS contract; errors in migration or propagation logic could affect opt-out status reporting.

Overview
Adds a new optOutFormSubmittedDate timestamp to PIR opt-out reporting. A nullable optOutFormSubmittedDate column is added to pir_optout_job_record (Room schema v16 w/ auto-migration) and mapped through OptOutJobRecordEntity � OptOutJobRecord.

JobRecordUpdater now stamps optOutFormSubmittedDateInMillis on the first successful form submission (both direct REQUESTED flows and PENDING_EMAIL_CONFIRMATION flows) and preserves the original value on retries. The dashboard state and WebView message payloads (initialScanStatus and maintenanceScanStatus) now include optOutFormSubmittedDate (seconds, nullable), with child brokers inheriting the most recent parent-broker submission timestamp and mirror-site results copying the parent match.

Tests are updated/added to validate the new field in message payloads, retry preservation behavior, and parent�child propagation rules.

^{Reviewed by Cursor Bugbot for commit c1b4eb9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[landomen]

Opening this and closing #8406