Phase 1: dual approval default, web-UI index jobs + merge review queue, thesis v2

- Dual sign-off is now the default (thesis_required_approvals defaults to 2).
- Entity-merge review queue (migration 0003): the fuzzy/Qwen tier no longer
  auto-merges — it writes CANDIDATES (entity_merge_candidates) with a same/different
  suggestion + confidence + reason for a human to approve (merge) or reject (keep
  separate). entity_merge.py applies/rejects (durable via entity_merges, soft-delete,
  repoint links+edges); decided pairs aren't re-surfaced.
- entity_jobs.py: UI-triggered background index jobs (rebuild/update/find-duplicates)
  as subprocesses with a one-at-a-time lock; status in /api/system/status.
- server.py: /api/index/{rebuild,update}, /api/entities/find-duplicates,
  /api/entities/merge-candidates [+ /{id} decide] — admin-gated.
- docs/thesis-seed-v2.md: concrete, plain-English rewrite per Grant's feedback.

Backend verified end-to-end on synthetic data (candidate gen -> approve/reject).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/thesis_review.py

@@ -37,11 +37,13 @@ def _log(c, actor_id, action, target_id, payload):
 
 
 def required_approvals(c):
+    # Default 2 = dual sign-off (both partners). Override via app_settings
+    # 'thesis_required_approvals' if you ever want single-approver.
     r = c.execute("SELECT value_json FROM app_settings WHERE key='thesis_required_approvals'").fetchone()
     try:
-        return max(1, int(json.loads(r[0]))) if r else 1
+        return max(1, int(json.loads(r[0]))) if r else 2
     except Exception:
-        return 1
+        return 2
 
 
 def _approver_count(c, version_id):