fix(intercept): judge decisions were stored as unknown (prefix case mismatch)

Since e233c02 the judge writer prefixes its reason with "[model]" while
interceptSource, the approvalDecisionSource SQL fallback and the archive
restore checked "[Model]", so model-decided rows were inserted with
decision_source='unknown' and missed by the decision_source=model filter.

- db: add ModelReasonPrefix ("[model]") and isModelReason, which also
  accepts the pre-e233c02 "[模型]" prefix; readers compare
  case-insensitively (lower(reason) LIKE in SQL).
- intercept: the writer builds its reason through JudgeReason, using the
  shared constant.
- schema.sql: idempotent backfill of 'unknown' rows without a rule whose
  reason carries either prefix.
- tests: un-skip TestInterceptFilterHTTP (it failed only because of
  this), make the db filter fixture use the constant, and add a
  Postgres-free test pinning the writer output to interceptSource.

Fixes #156

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
       - run: go build ./...
       - run: go vet ./...
       # Skipped tests, tracked in issue #9:
-      # - TestInterceptFilterHTTP, TestGraphOverviewExpandsAssociatedCompanyScope,
+      # - TestGraphOverviewExpandsAssociatedCompanyScope,
       #   TestCaptureApprovalLifecycle: fail on unmodified upstream code with a
       #   fresh database.
       # - TestSideUsageRecordedOnceOnConsumerCancellation: concurrency/cancellation