feat(intake): record who chose an item's price (#225)

Pure and separately tested because the failure it guards is silent. Items are priced on arrival, so the schema no longer stops a number nobody chose reaching the storefront — the review queue does, by showing that nobody chose it, and an item selling at a default price looks exactly like one selling at a chosen price.

Editing the number is the only thing that confirms it. Publishing an untouched field deliberately does not, because that would record "I did not look at this" as "I approved this".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/intake/priceSource.ts

@@ -0,0 +1,34 @@
+/**
+ * Where an item's price came from, and when that changes.
+ *
+ * This is the protection that used to live in the schema. Items are priced on
+ * arrival — the model's suggestion, or the 80.00 default — so nothing stops a
+ * number nobody chose from reaching the storefront except the review queue
+ * showing that it was never chosen.
+ *
+ * Pure and separately tested because the failure is silent. An item that sells
+ * at a default price looks exactly like one that sells at a chosen price;
+ * 80.00 was picked precisely because it reads as a decision rather than as an
+ * obvious sentinel the way 0.00 would.
+ */
+export type PriceSource = 'default' | 'ai' | 'admin';
+
+/**
+ * Editing the number is the admin taking responsibility for it, and it is the
+ * only thing that can. Publishing without touching the field deliberately does
+ * NOT confirm it — that would turn "I did not look at this" into "I approved
+ * this", which is the exact misrecording the review queue exists to prevent.
+ */
+export function nextPriceSource(
+  current: PriceSource,
+  submittedCents: number,
+  storedCents: number
+): PriceSource {
+  if (current === 'admin') return 'admin';
+  return submittedCents === storedCents ? current : 'admin';
+}
+
+/** Anything a person did not choose, which the screen marks visibly. */
+export function isUnconfirmed(source: PriceSource): boolean {
+  return source !== 'admin';
+}