[feat-023] Tabular review filtering + cell verified state

User-facing: filter the table by flag, verified state, and per-column
text predicates. Mark cells verified with a hover ✓ button so the
verified-state filter has something to bite on. Critical when reviews
have more than ~50 docs and the user is hunting for "just the red
ones" or "the cells I haven't checked yet".

Backend:
- Migration 006: tabular_cells gains verified bool (default false),
  verified_at timestamptz, verified_by uuid → auth.users. Additive,
  safe against live data.
- PATCH /tabular-review/:reviewId/cells/verify - toggles a single
  cell's verified state. Records who/when. Reuses ensureReviewAccess.

Frontend:
- trFilterPredicate.ts - pure (cell, filter) → boolean +
  computeVisibleDocIds(docs, cells, filters) → Set<docId>. Operators:
  contains / does not contain / is / is not / is empty / is not empty.
  AND across multiple filters. Flag + verified filters union per-doc;
  text filters scoped to their column. 11 unit tests pass.
- TRFilterBar.tsx - pill row above the table. Active-filter pills with
  ✕ removal. + Add filter popover with Flag (multi-select) / Verified
  (radio) / Column-value (column → operator → value) tabs.
  "Showing N of M documents matching K filters" caption. Clear all link.
- TabularCell.tsx - hover-revealed ✓ button (top-left). Always visible
  when verified (subtle green check); fades in on hover when not.
- TabularReviewView wires filter state in localStorage per
  (review, device); applies via computeVisibleDocIds composed on top of
  the existing doc-name search; mounts TRFilterBar above the table when
  any columns exist; passes onToggleVerifyCell to TRTable.
- TRTable threads the verify handler through to TabularCell and grows
  pl-4 padding when verify is enabled so the ✓ doesn't overlap content.
- TabularCell type extended with verified / verified_at / verified_by;
  no API mapping change needed (Supabase JS auto-includes selected
  columns, and TabularReviewDetailOut → TabularCell[] passes through).

mikeApi: setTabularCellVerified helper added.

Verified: tsc clean both sides; 11 new frontend predicate tests pass via
bun test; 16 backend tests still pass; migration 006 applied locally
(verified column non-null with default false; verified_at + verified_by
nullable).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>