Add secure conflicts check workflow

From the PR description

What changed

• add backend-only conflict records for client, matter, party, and affiliate relationships
• add owner-scoped, MFA-aware APIs for structured search, reviewer decisions, and conflicts audit history
• add a dedicated Conflicts page and sidebar entry
• require a human reviewer to record either cleared or conflict_found with rationale
• add database migration, schema updates, validation helpers, and unit tests

Why

Conflicts data is sensitive and should not be exposed through broad project, library, search, or general-history endpoints. This creates a small end-to-end workflow with dedicated storage and access controls while treating search results only as potential matches.

Security and user impact

Browser roles have no direct access to the conflicts tables, RLS is enabled without permissive policies, and every API query is scoped to the authenticated owner. Searches remain pending_review until a human records a decision; the application never automatically clears a conflict.

Validation

• backend tests: 556 passed, 23 skipped
• backend TypeScript check: passed
• frontend TypeScript check: passed
• targeted frontend lint: passed
• frontend tests: 276 passed; 4 existing Blob.text() export assertions failed under the available local runtime/dependency combination and are unrelated to this change
• git diff --check: passed