fix(settings): address audit findings across settings and billing - #1524

🟢 Confidence 8/10 · likely safe to merge
The revision guard in PolicySimulator is the risky part and reads correctly; the schema plan matches reconcileSchemaSnapshot line for line.
_{quality 100/100 · no findings · tests partial · risk medium}

The four changed settings files add a revision guard to the policy simulator, lock the escalation draft during saves, and gate ClickHouse Apply behind a confirm dialog that lists the plan. Safe to merge.

• schemaApplyPlan replaces leftAlone with unresolved plus a reason per entry
• PolicySimulator hides a decision whose revision predates an edit
• Escalation controls lock while a save is in flight
• ClickHouse Apply now opens a ConfirmDialog showing the plan

Fixed since the last review

• ✅ F1 · leftAlone lists tables Apply will ADD COLUMN to

Production impact

_{2646990 · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}