fix(api): finish moving investigation queries to the unified schema

[bordumb]

Stacked on #183. Merge #183 first; this PR's base is #183's branch, so the diff shows only this change.

Summary

Follow-up to #183. These call sites still read columns that 013_unified_investigation.sql dropped, and they failed at runtime:

1. Dashboard
   • get_dashboard_stats filtered on completed_at and on status values the generated status column never takes.
   • Migration 036 adds investigations.completed_at, set by a trigger the first time outcome is set. "Completed Today" counts completed_at today, and "Active" counts investigations with no outcome. The migration is re-runnable and has no BEGIN/COMMIT.
   • list_investigations now returns summaries from the alert JSONB: primary dataset, metric display name (else anomaly type) and severity. Imported replays show "unknown" instead of crashing GET /dashboard/.
   • Frontend: fetchDashboardStats requested /dashboard/stats without /api/v1, so it always failed and fell back to mock 3/7/2 numbers. It also read camelCase keys the API never sends. It now uses the generated client and maps the response, and DashboardStatsCards shows "—" and an error when loading fails.
2. RBAC: PermissionService joined grants on investigations.data_source_id. The whole EXISTS/UNION query failed, so every can_access_investigation call raised. It now compares pg.data_source_id::text with alert->>'datasource_id' (4 places).
3. Fix feedback export: the investigation context read investigations.issue_id. The new FixFeedbackService.investigation_context() names the latest issue from issue_investigation_runs, and leaves issue_id out when there's none.
4. EE runbooks
   • Generating a runbook from an issue read issues.resolution/metadata and investigations.issue_id/synthesis. It now uses resolution_note, issue_labels and the latest linked investigation's outcome, and the route records that investigation in created_from_investigation_id.
   • _row_to_response now decodes JSONB text. AppDatabase has no JSONB codec, so every runbook route failed list validation before this.

Not changed: the issue route's AnomalyAlert was already fixed by #159. Sharing one issue→alert helper between CE and EE is deferred (flow fn-16.21).

Tests

Each test was written first and failed for the expected reason before the fix, all against the migrated schema via migrated_db:

• test_investigation_completed_at.py
• api/test_dashboard.py
• core/test_permission_service.py
• test_fix_feedback_export_context.py
• EE api/test_runbook_from_issue.py
• Frontend: lib/api/dashboard.test.ts, features/dashboard/dashboard-stats.test.tsx

Backend CI only runs on PRs into main, so this stacked PR gets none. Verified locally on this branch (#183 + this commit):

• CE pytest: 2122 passed
• EE pytest: 470 passed
• CE integration: 9/9; EE integration: 8/8
• mypy: clean
• ruff (venv 0.14) and pinned hook ruff 0.3.0: clean
• Frontend: typecheck, lint and 29/29 tests pass

The same change merged onto current main was also green except for #150's approvals POLICY entries, which #183 has to drop.

Merge notes

• fix(api): stop writing pre-013 investigation columns and remove approvals #183 needs a rebase first. It conflicts with fix(api): use dataset_ids consistently for investigation alerts #159 on the integration conftest (take main's version). Since feat(api): enforce org roles on every mutating route and in the UI #150 merged, the 4 ("POST", "/approvals/...") entries also have to come out of test_route_authorization.py.
• fix(ee): stop repeated runbook feedback from inflating usefulness_score #177 already conflicts with main in provide_link_feedback, separately from this PR. This PR's runbooks.py hunks merge cleanly with it.
• Uncommitted busy-cartwright work (fn-59, tenants → organizations): its JSONB codec rejects JSON text. The integration tests here insert with json.dumps, so they'll need converting when that lands. The new source reads accept both text and decoded values.

🤖 Generated with Claude Code

[vercel]

Deployment failed for project dataing with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/bordumbs-projects?upgradeToPro=build-rate-limit

[vercel]

Deployment failed for project dataing-docs with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/bordumbs-projects?upgradeToPro=build-rate-limit

[vercel]

Deployment failed for project dataing-app with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/bordumbs-projects?upgradeToPro=build-rate-limit