Make requests and approval delivery recover safely

[mayvqt]

Request confirmations now submit once, finite quotas are displayed and enforced correctly, and shows with more than 25 seasons have a complete selector. Approval decisions, notifications and card cleanup recover independently after failures and restarts.

• Preserve selections across season pages, support clearing them, and prevent concurrent or stale interactions from replacing a completed response.
• Distinguish a rejected/no-op request from an uncertain POST outcome; prevent unsafe repeat submissions. Check explicit account links with four bounded workers and reject incomplete or ambiguous scans.
• Save decision intent before updating Seerr, retain the moderator and decline reason after a lost response, and show the canonical result on stale buttons. Failed updates preserve the card; damaged legacy cards can be rebuilt.
• Use expiring, fenced approval-send claims and durable notification/cleanup work. Repair cards independently of pending-request polling, honor current notification preferences, and keep retries fair after timeouts.
• Fence card acknowledgements and deletion by physical message identity. Drain accepted interactions on shutdown and failed startup, with a 45-second container stop allowance.

Upgrade: back up the complete data directory before schema revision 6. Existing subscriptions, settings and notification receipts are preserved; interrupted blank claims can recover. Migration does not replay historical decision notifications. Rollback needs the matching pre-upgrade data. See docs/development/operations.md.

Validation: affected Go race tests and vet passed, including revisions 1–5, repeat/rollback, lost Seerr responses and local saves, failed DMs, preference suppression, stale cards, decoded modal payloads, startup/shutdown and maintenance timeouts. The synthetic 20-user lookup benchmark improved from 21.5 ms serial to 5.6 ms with four workers. The final CI gate passed on a77fa436a384925f55693ad63aee7d7d2cdb817e, including Go checks and Docker; dependency review also passed. Local Go 1.27.1 checks are supplementary to that specified-toolchain gate.

Limits: no live Discord server or production Seerr data was used. Discord client layout/keyboard checks remain for a dedicated test server. Discord delivery is at least once: a crash after remote acceptance but before a durable receipt can duplicate a message; known extra cards are retained for cleanup.