Add Review Opportunities discovery and Design previews

[jmgasper]

Summary

• add server-filtered review opportunity search and paginated current-user application routes
• expose exact application-role contracts and challenge Markdown for opportunity detail
• expose public-safe applicationCount totals separately from approved-capacity counts without revealing applicant identities on list/search routes
• preserve the Figma applicant panel on caller-visible opportunity detail and challenge routes
• validate optional bearer identity on GET /review-applications/opportunity/:opportunityId, apply the canonical challenge whitelist/group/task boundary before querying applicants, and return the same 404 contract for missing and hidden opportunities
• replace placeholder applicant workload values with authoritative openReviews and 60-day latestCompletedReviews totals resolved in one batch query
• bound approved-count aggregation to only the opportunity IDs returned on the current page
• enforce reviewer eligibility, capacity, duplicates, role compatibility, challenge lifecycle, whitelist, groups, and task-resource visibility
• rely on the composite database uniqueness constraint for concurrent duplicate applications and return HTTP 409 for the losing insert
• preserve closed/cancelled opportunity history after challenge completion while keeping open work ACTIVE-only
• keep list payloads lazy: caller-only applications, database counts, and one batch challenge projection
• generate safe Design submission previews after passing Screening or Checkpoint Screening
• continuously reconcile missed and historical preview jobs, then release only after the matching actual phase end
• add a public-safe paginated released-preview gallery plus the existing single-preview redirect
• publish the Review Prisma client for opportunities-api-v6
• fix mixed-challenge submission sanitization so a reviewer-visible row cannot skip later protected rows

Validation

• pnpm lint passed
• pnpm build passed
• 56/56 focused opportunity, applicant visibility, group/task/whitelist privacy, metric batching, challenge visibility, and preview tests passed
• git diff --check passed
• full repository: 25 suites / 433 tests pass; 4 suites / 8 tests fail in pre-existing unrelated appeal mocks, AI SQL assertion/nanoid Jest loading, and legacy submission expectations
• Prisma/client package validation was completed in the initial branch delivery

See docs/REVIEW_OPPORTUNITIES.md and docs/SUBMISSION_PREVIEWS.md.