Approve equipment registrations and edits automatically

[Navid Gholizadeh (ngholiza)]

Summary

• Auto-approval. Equipment registrations and edits by non-admins go live immediately instead of waiting in the admin review queue. Controlled by EQUIPMENT_AUTO_APPROVE, which defaults to on; set it to false to bring the review queue back without a code change.
• Admins are still told. Each auto-approved registration or edit sends an "Equipment auto-approved" notice by Teams and email, linking to the equipment page. The submitter is recorded as reviewer, as admin self-approval already does.
• Snapshots can't go stale. Every change to a config snapshot (registration, edit, review decision, deletion) now goes through sync_config_snapshot. It re-reads the committed row under a per-equipment file lock, then writes or removes the snapshot to match, so two saves at nearly the same moment can't leave the older definition on disk.
• UI text. The registration and edit pages no longer say changes go back to review.

Testing

• The full API suite passes against a disposable Postgres 15 (216 passed). The old review-flow tests are pinned to EQUIPMENT_AUTO_APPROVE=false, and two new tests cover auto-approval: status, reviewer fields, notices, and snapshot refresh through the API routes.
• Codex review approved after four rounds. It found the snapshot races and a notification dedupe-key truncation issue; both are fixed.
• test_rcac_runner.py fails to import (rcac_runner has no source in the repo, only a stale .pyc). This is unrelated and pre-existing.

Deploy

API change, no schema change. Per the usual procedure: build the API image, run the dt-db-migrate Job with it, then kubectl set image on dt-api and cronjob/dt-api-retrain; also rebuild dt-web for the text change.

🤖 Generated with Claude Code