Add a moderation queue for user submissions

Completes TODO #3. Submissions are gated behind ACCEPT_SUBMISSIONS,
which defaults to off: is_allowed() treats everyone as allowed when
ALLOWED_USERS is empty, so opening submissions implicitly would have
accepted media from anyone who found the bot.

- Schema v3 adds status, reviewed_by and reviewed_at. Existing rows
  default to approved, so upgrading changes nothing for a running bot.
- Search, /list and counts only return approved items; callers that
  need everything pass status=None.
- /review shows the oldest pending item with approve, reject, fix
  keywords and stop. No cursor is stored anywhere: each action just
  asks for the next pending item, which is what lets a moderator stop
  and resume later, and lets several moderators share one queue.
- set_status only updates rows still pending, so if two moderators open
  the same item the first decision wins and the second is told so.
- A failed send no longer wedges the queue; the item's details are
  shown anyway so it can still be rejected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test_db.py

@@ -47,10 +47,13 @@ async def test_legacy_upgrade(tmp: str):
     db = load_db(path)
     await db.init_db()
 
-    assert user_version(path) == 2
+    assert user_version(path) == 3
     rows = sorted((r["id"], r["keywords"]) for r in await db.search_media(""))
     assert rows == [(7, "cat,funny"), (9, "dog")], f"rows not preserved: {rows}"
-    print("  legacy v1 database upgrades to v2 with ids and keywords intact")
+    with sqlite3.connect(path) as c:
+        statuses = {r[0] for r in c.execute("SELECT status FROM media")}
+    assert statuses == {"approved"}, f"upgraded rows must stay live: {statuses}"
+    print("  legacy v1 database upgrades with ids, keywords and visibility intact")
 
 
 async def test_per_owner_uniqueness(tmp: str):
@@ -88,18 +91,88 @@ async def test_fresh_and_idempotent(tmp: str):
     with sqlite3.connect(path) as c:
         sql = c.execute("SELECT sql FROM sqlite_master WHERE name='media'").fetchone()[0]
     assert "UNIQUE(owner_id, file_unique_id)" in sql
-    assert user_version(path) == 2
+    assert user_version(path) == 3
 
     await db.init_db()
     await db.init_db()
-    print("  fresh install lands on v2; init_db is idempotent")
+    print("  fresh install lands on the current version; init_db is idempotent")
+
+
+async def test_pending_is_hidden(tmp: str):
+    path = os.path.join(tmp, "pending.db")
+    db = load_db(path)
+    await db.init_db()
+
+    await db.add_media(111, "F1", "U1", "photo", ["live"])
+    await db.add_media(222, "F2", "U2", "photo", ["waiting"], status="pending")
+
+    assert len(await db.search_media("")) == 1, "pending items must not be searchable"
+    assert await db.count_media() == 1
+    assert len(await db.list_media(0, 30)) == 1, "pending items must not appear in /list"
+    assert len(await db.search_media("", status=None)) == 2, "status=None should see everything"
+    assert await db.count_pending() == 1
+    print("  pending items stay out of search, /list and counts until approved")
+
+
+async def test_queue_is_oldest_first(tmp: str):
+    path = os.path.join(tmp, "queue.db")
+    db = load_db(path)
+    await db.init_db()
+
+    for i in range(3):
+        await db.add_media(100 + i, f"F{i}", f"U{i}", "photo", [f"kw{i}"], status="pending")
+
+    first = await db.next_pending()
+    assert first["keywords"] == "kw0", f"queue must be oldest-first, got {first['keywords']}"
+
+    # Approving removes it from the queue and the next one steps up.
+    assert await db.set_status(first["id"], "approved", 999) is True
+    second = await db.next_pending()
+    assert second["keywords"] == "kw1"
+    assert await db.count_pending() == 2
+    print("  queue serves oldest first and advances as items are handled")
+
+
+async def test_two_moderators_cannot_double_review(tmp: str):
+    path = os.path.join(tmp, "race.db")
+    db = load_db(path)
+    await db.init_db()
+
+    await db.add_media(111, "F1", "U1", "photo", ["kw"], status="pending")
+    item = await db.next_pending()
+
+    assert await db.set_status(item["id"], "approved", 111) is True
+    assert await db.set_status(item["id"], "rejected", 222) is False, \
+        "a second moderator must not overwrite a completed review"
+
+    row = await db.get_media_by_id(item["id"])
+    assert row["status"] == "approved", "first review must win"
+    print("  a second moderator cannot overturn an already-reviewed item")
+
+
+async def test_rejected_stays_hidden(tmp: str):
+    path = os.path.join(tmp, "rejected.db")
+    db = load_db(path)
+    await db.init_db()
+
+    await db.add_media(111, "F1", "U1", "photo", ["nope"], status="pending")
+    item = await db.next_pending()
+    await db.set_status(item["id"], "rejected", 999)
+
+    assert await db.search_media("nope") == [], "rejected items must never surface"
+    assert await db.count_pending() == 0
+    assert await db.next_pending() is None
+    print("  rejected items leave the queue and never surface in search")
 
 
 async def main():
     sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
     with tempfile.TemporaryDirectory() as tmp:
         for test in (test_legacy_upgrade, test_per_owner_uniqueness,
-                     test_readd_keeps_id, test_fresh_and_idempotent):
+                     test_readd_keeps_id, test_fresh_and_idempotent,
+                     test_pending_is_hidden, test_queue_is_oldest_first,
+                     test_two_moderators_cannot_double_review,
+                     test_rejected_stays_hidden):
             await test(tmp)
     print("\nAll database tests passed.")