Demote broadcast auth sign-in confirmations

[99Yash]

Summary

• demote urgent -> fyi only for group-broadcast auth sign-in confirmations that say no action is needed if recognized
• keep direct service auth alerts urgent
• clear todo suggestions when the sender-kind floor demotes these broadcasts

Prod verification

• Railway server is on Demote passive collaboration notifications #390 deploy b95c503; the latest OpenAI sign-in row was classified after deploy at 2026-07-03T11:45:37.626Z
• Prod DB shows doc_8yxvc2oxq7wl / thread 19f27cc4b9b6092b stored as urgent with todo "Review OpenAI account security"
• Active projection resolves engineering@oliv.ai as group, confidence 0.99, evidence gmail:list_id + gmail:list_unsubscribe + gmail:precedence:list
• Local deterministic replay with those facts returns demoted=true, category=fyi, todoSuggestion=null

Tests

• CI=true corepack pnpm --filter @alfred/api test -- test/triage/classify.test.ts
• CI=true corepack pnpm --filter @alfred/api check-types