feat: verify resident apartment-scoped authz + fail-safe approval

[ankitsejwal]

Verifies the resident-apartment visitor authorization (#36) end-to-end and hardens the approval endpoint. No new feature surface — onboarding was already built; this closes the verification gap and fixes a robustness bug found along the way.

Changes

• Seed a demo PENDING resident (DEV_RESIDENT_ID, no residency) so the admin approval flow and the apartment-scoped authz can be exercised locally.
• Fail-safe user approval: the approve endpoint used to flip the user to APPROVED then insert the residency, so a bad apartmentId left a half-approved user (APPROVED, no residency). Now it validates the user + apartment exist, inserts the residency, and flips status last — a failure leaves the user PENDING and retryable. (neon-http has no interactive transactions, hence the ordering.)

Verified E2E (Chrome DevTools + live Neon)

• Onboarding: approved the demo resident via /admin/residents → assigned B-201 → status went PENDING→APPROVED, residency created.
• Authz (fix(api): scope resident approve/deny to their own apartment #36), acting as the resident via x-user-id:
  • approve own apartment (B-201) → 200
  • approve other apartment (A-101) → 403 not a resident of this apartment
  • deny other apartment → 403
  • admin override on A-101 → 200
• Approval fail-safe (probe users, then cleaned up): valid apartment → 200, APPROVED + 1 residency; bogus apartment → 404, user stays PENDING + 0 residencies.
• Full gate green (check-types, lint, test).