jobs: give Unclassified DLQ rows a resolution path and retention exemptions (K-1)

apps/api/Data/DbContext/AppDbContext.cs

@@ -80,6 +80,9 @@ public DbSet<JobQueueItem> JobQueue {
 	public DbSet<JobDeadLetter> JobDeadLetter {
 		get { return Set<JobDeadLetter>(); }
 	}
+	public DbSet<JobDeadLetterEvent> JobDeadLetterEvent {
+		get { return Set<JobDeadLetterEvent>(); }
+	}
 
 	// Dashboard-configurable recurring system jobs, reconciled into the leader's Quartz
 	// scheduler by SyncSystemJobsJob (design §4.3).

apps/api/Lib/AppPermissions.cs

@@ -5,6 +5,7 @@
 using PublyApp.Api.Modules.Calendar.Permissions;
 using PublyApp.Api.Modules.Channels.Permissions;
 using PublyApp.Api.Modules.Invitations.Permissions;
+using PublyApp.Api.Modules.Jobs.Permissions;
 using PublyApp.Api.Modules.Media.Permissions;
 using PublyApp.Api.Modules.Permissions.Entities;
 using PublyApp.Api.Modules.Permissions.Permissions;
@@ -37,6 +38,9 @@ public class StaffScopePermissions : IScopePermissions {
 	public SystemNoticePermissionsForStaff SystemNotices { get; } = new SystemNoticePermissionsForStaff();
 	public AuditLogPermissionsForStaff AuditLogs { get; } = new AuditLogPermissionsForStaff();
 	public UploadPermissionsForStaff Uploads { get; } = new UploadPermissionsForStaff();
+	// K-1 (#863): the jobs slice ships permission-first; its only surface today is
+	// the dead-letter resolve-unclassified triage endpoint.
+	public JobsPermissionsForStaff Jobs { get; } = new JobsPermissionsForStaff();
 }
 
 public class TenantScopePermissions : IScopePermissions {

apps/api/Lib/DI/ServiceAttributeRegistration.Spec.cs

@@ -11,6 +11,7 @@
 using PublyApp.Api.Modules.Auth.Services;
 using PublyApp.Api.Modules.Impersonations.Services;
 using PublyApp.Api.Modules.Invitations.Services;
+using PublyApp.Api.Modules.Jobs.Services;
 using PublyApp.Api.Modules.Messaging.Services;
 using PublyApp.Api.Modules.Permissions.Services;
 using PublyApp.Api.Modules.Posts.Services;
@@ -43,6 +44,7 @@ Type ImplementationType
 		(typeof(IAuditLogService), typeof(AuditLogService)),
 		(typeof(IAuthService), typeof(AuthService)),
 		(typeof(IEmailLogWriter), typeof(EmailLogWriter)),
+		(typeof(IJobDeadLetterService), typeof(JobDeadLetterService)),
 		(typeof(ICreateStaffUserService), typeof(CreateStaffUserService)),
 		(typeof(IInvitationAcceptanceService), typeof(InvitationAcceptanceService)),
 		(typeof(IImpersonationService), typeof(ImpersonationService)),

apps/api/Localization/ResponseKeys.g.cs

@@ -49,6 +49,21 @@ public static partial class ResponseKeys {
 	/// </summary>
 	public static readonly TranslationKey CreateFirstItem = new("create-first-item");
 
+	/// <summary>
+	/// Dead-letter entry not found
+	/// </summary>
+	public static readonly TranslationKey DeadLetterNotFound = new("dead-letter-not-found");
+
+	/// <summary>
+	/// Dead-letter entry is not awaiting unclassified triage
+	/// </summary>
+	public static readonly TranslationKey DeadLetterNotUnclassified = new("dead-letter-not-unclassified");
+
+	/// <summary>
+	/// Dead-letter triage resolved
+	/// </summary>
+	public static readonly TranslationKey DeadLetterResolvedSuccess = new("dead-letter-resolved-success");
+
 	/// <summary>
 	/// delete {{item}}
 	/// </summary>