Add versioned decision case storage

[falltwo]

This PR adds versioned storage for decision cases. Event evidence, exposure mappings, scenario inputs, and result references are persisted in an isolated SQLite database and remain readable after reconnecting. When scenario inputs change, the service can also identify older results as stale.

Evidence, human overrides, and scenario inputs append a new version instead of replacing history. A persistent BEFORE INSERT trigger blocks INSERT OR REPLACE attempts that reuse either a composite key or a rowid. The protection does not depend on recursive_triggers and works with the older SQLite version used by GitHub Actions.

Authorization continues to use the existing capability model. Each operation resolves the principal again and binds it to the current deployment organization, so an account with the same name in another organization cannot inherit that identity. Missing mappings remain unknown or unmapped; they are never treated as safe.

Testing

• Decision Case suite: 40 passed
• Full regression suite: 367 passed
• Independent SQLite and authorization probes: exit 0
• Combined with the Scenario branch: 454 passed
• GitHub Actions: passed

Scope

This change covers case persistence and version protection only. Proposal, approval, receipt, ERP write-back, Streamlit session authorization, MCP, DBOS, ORM integration, and production database migration remain outside this PR.