Phase 7 follow-up: expose tier-4 'needs review' queue in migration report

[deOliveira-R]

Plan §6 Phase 7 step 5 asks migration to produce:

N items imported, M internal duplicates detected, K flagged for manual review

The current `MigrationReport` captures `inserted`, `merged`, `skipped_*`, `pdf_attachments_stored`, and `failures`, but not the tier-4 semantic-ambiguity band (0.90 ≤ sim < 0.97 with author overlap and no LLM judge available) that `dedup._tier4_semantic` currently just skips without surfacing.

Proposal

1. Change `dedup.decide` (or a new sibling function) to optionally return a "review" outcome carrying the neighbor id + sim + reason — distinct from the terminal insert/merge/link/skip decisions.
2. Migration records those as entries in `MigrationReport.review_queue` and writes them to a `review_queue` table (new migration — needs schema approval).
3. Extend `grimoire dedup-scan` with `--review-queue` to re-examine these rows after the fact.

Acceptance

• `MigrationReport.review_queue` populated during `grimoire migrate zotero`.
• Flagged pairs inspectable via CLI (`grimoire dedup-scan --review-queue`) or the web UI.
• User can resolve: merge, link-as-related, or assert-not-duplicate (which writes `non_duplicate_pairs`).
• Plan §7 invariant 9 (`a_id < b_id`) respected for any `non_duplicate_pairs` writes from this flow.