Event-sourced applicant/subscriber/project aggregates, generalized resources

Replaces the free-string, direct-KV-mutate state model in answers.rs
with a proper event log (events/store.rs, JetStream-backed, CAS via
expected_last_subject_sequence) and three pure state machines
(aggregates/{applicant,subscriber,project}.rs). Closes a real
lost-update race in the old transition_answer (concurrent decisions on
the same item could both win, publishing contradictory events). KV
buckets become best-effort read-model projections, not the source of
truth. Content-declared transition targets are now validated at
load/reload time against the real compiled transition tables, not
accepted as arbitrary strings.

Buckets renamed to describe their content, not their relation to the
app (portal_applicants -> applicants, etc); "inquiry" folded into a
richer "project" concept.

ResourceSpec generalized beyond a single KV bucket: Kv | GiteaStarred |
GiteaOrgRepos | Url sources, with an optional jq filter (via the jaq
crate) to shape live data for the frontend. Url source is SSRF-guarded
(https-only, rejects loopback/private/link-local, real DNS resolve).

New headless question_lint binary (validates content against compiled
transition tables with no NATS/OIDC/server involved) and a one-time
backfill_events binary (dry-run by default) for migrating existing KV
data onto the new event log.

Questions get an optional `responsible` contact plus a lightweight
"report this question" action.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/events/mod.rs

@@ -0,0 +1,32 @@
+//! Plain NATS event publishing - ported from dodrenett's lib/nats.ts
+//! (AnswerSubmitted). Deliberately just a publish, no stream/consumer
+//! bookkeeping here: whoever reads `portal.answers.submitted` today is a
+//! person watching the subject; a future LLM-driven follow-up poster
+//! reads the exact same subject and shape, so this doesn't need to
+//! change shape when that shows up, only gain a second subscriber.
+#![cfg(feature = "ssr")]
+
+pub mod store;
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AnswerSubmitted {
+    pub chain_hash: String,
+    pub parent_hashes: Vec<String>,
+    pub question_id: String,
+    pub alternative: String,
+    pub responses: serde_json::Value,
+    pub timestamp_ms: i64,
+}
+
+pub const ANSWERS_SUBJECT: &str = "portal.answers.submitted";
+
+pub async fn emit_answer_submitted(
+    nats: &async_nats::Client,
+    payload: &AnswerSubmitted,
+) -> anyhow::Result<()> {
+    let data = serde_json::to_vec(payload)?;
+    nats.publish(ANSWERS_SUBJECT, data.into()).await?;
+    Ok(())
+}