feat: review uncertain weekly brief deliveries with audit history

tests/http-state.test.mjs

@@ -265,3 +265,25 @@ test('weekly brief preference loads without feed preview and changes only with a
  assert.equal((await request('/api/me/brief','GET',null,other)).data.kapali,false);
  assert.equal((await request('/api/me/brief','POST',{kapali:false,revision:saved.data.revision})).status,200);
 });
+
+test('weekly brief review is admin-only and persists evidence without sending messages',async()=>{
+ const route='/api/admin/brief/outbox';
+ assert.equal((await request(route,'GET',null,null)).status,401);
+ assert.equal((await request(route)).status,403);
+ assert.equal((await request(route,'POST',{id:'x',action:'skip',note:'Yetkisiz işlem kontrolü.'})).status,403);
+ const admin=signToken({email:'weekly-admin@example.test',name:'Admin',isAdmin:true});
+ const {createBriefOutbox}=await import('../server/brief-outbox.mjs');
+ const box=createBriefOutbox(dir),batch=box.prepare('2026-09-07','weekly-test@example.test',[{channel:'email',to:'weekly-test@example.test'}]);
+ box.hold(box.claim(batch.id,0),'Test sonucu belirsiz');
+ const list=await request(route,'GET',null,admin);
+ assert.equal(list.status,200);assert.equal(list.data.deliveries.length,1);
+ const id=list.data.deliveries[0].id;
+ assert.equal((await request(route,'DELETE',null,admin)).status,405);
+ const input={id,action:'confirmed_sent',providerId:'test-provider-receipt',confirmed:true,note:'İzole test sağlayıcı kaydı doğrulandı.'};
+ assert.equal((await request(route,'POST',{...input,confirmed:false},admin)).status,400);
+ assert.equal((await request(route,'POST',input,admin)).status,200);
+ assert.equal((await request(route,'POST',input,admin)).status,409);
+ const saved=(await request(route,'GET',null,admin)).data.deliveries[0];
+ assert.equal(saved.review.actor,'weekly-admin@example.test');assert.equal(saved.providerId,input.providerId);
+ assert.equal(saved.state,'sent_manual');
+});