[amar-python]

Refs #108. This is part M4b of ART Milestone 4, the review screen. It's stacked on #142, the review API. Merge #142 first, and this PR's base then moves to main.

What it does

• A Review link on each migrated file opens /review/{uploadId}.
• The screen pages through every stored row, 100 at a time, with each column's type:
  • Invalid cells are red, and their title gives the reason.
  • Edited cells are tinted, and their title gives the original value.
  • Each row shows Included, Invalid or Excluded.
• Reviewers and tenant admins can exclude or include a row, and edit a cell by clicking it. Both open a dialog with a required Reason: Save stays disabled until one is entered. An edit shows the original value. Other roles see a note, with no edit or exclude controls. The API refuses them anyway.
• A history button per row lists its decisions and edits: who, when and why.
• The page says that changes are saved with the upload for review and don't change the imported table (decision 1 on ART M4: review — full paging, include/exclude, versioned cell edits (BR-25, BR-26, BR-27) #108).
• scripts/e2e/m4-review.js is a repeatable browser check. It needs E2E_TENANT, E2E_USER and E2E_PASSWORD, and a running API and frontend.

Found by the end-to-end check, fixed in #142

The browser's preflight for PUT was refused, because CORS allowed only GET, POST and DELETE. The unit tests mock the network, so they couldn't catch it. #142 now allows PUT and has a test that fails without it.

Verification

Check	Result
vitest	15 files, 147 tests passed, 4 of them new (review-table.test.tsx): rows, validation, edits and decision shown; a reviewer excludes with a required reason; a tenant admin edits a cell; an uploader can view but not change
tsc --noEmit	0 errors
eslint and prettier on the new and changed files	Clean (prettier changed only the additions)
Production build (node-server)	Built; the route tree is regenerated with the new route
End to end (scripts/e2e/m4-review.js)	Run against the API (PostgreSQL 16) and the production frontend, signed in as a tenant admin. 8 of 8 PASS: 3 rows listed; row 2 flagged invalid; row 3 excluded; row 2 valid after its edit; edit and original still shown after a reload; history shows actor and reason; imported table unchanged; no page errors

I broke the component to check that the tests catch it. With Save enabled while the reason is empty, the exclude test failed (1 failed, 3 passed).

VCRM: BR-25 and BR-26 are now ✅ (API plus e2e), joining BR-27 from #142. The headline is now 23 of 38.

---

Generated by Claude Code