fix(newsletter): allow drafts to send immediately

[bokelley]

Summary

• let administrators approve and send a draft newsletter in one action
• serialize manual and scheduled delivery with a shared PostgreSQL advisory lock
• re-read edition state under the lock and report busy, invalid, and failed delivery outcomes clearly
• add coverage for draft sending, contention, scheduled delivery, and UI recovery

Closes #6532

Validation

• npm run precommit
• targeted newsletter unit tests (9 tests)
• code, security, and test expert reviews

[aao-secretariat]

Ladon verdict: Approve

Approve — operational newsletter delivery fix; no blocking findings.

What I checked:

• Scope is server/admin/newsletter/digest only — no static/schemas/source/**, docs/reference/**, dist/**, or other published protocol surface. No changeset required (correctly identified as operational-only).
• No schema↔docs coherence, oneOf discriminator, released-artifact immutability, or governance-precedent concerns apply — the diff does not touch the protocol surface.
• high_risk is true only because server/src/addie/jobs/weekly-digest.ts matches server/src/addie/**, but the change-kind is (modified) and the reviewer found no medium-or-higher concern on it. Presumed safe per the high-risk-flag rules.
• Both reviewer findings are low (Slack "Delivery failed" copy on lock contention; long-held advisory lock without timeout) — omitted from blocking analysis.
• Advisory-lock wrapper serializes all three send paths with matching keys, re-reads and ships only approved rows under the lock (closes double-send window), fail-closed, well-tested.

Decision table: No critical/high findings (row 1 no). gated_paths: false (row 2 no). No (deleted) high-risk reason (row 3 no). No medium findings at all (rows 4, 5, 8 no). No prior escalate (row 6 no). No no-auto-approve team match (row 7 no). Falls through to row 9 → approve.

Note: review_decision is REVIEW_REQUIRED, but gated_paths is false and no prose hard-gate (spec ownership, breaking-class change, major-version bump) applies to this server-only operational diff, so the required-review status does not force escalation.