Adds two read-only endpoints so the dashboard can surface HITL
operator-step pauses without scanning every run:

  - GET /api/workflows/runs/{run_id}/operator
    Returns `{run_id, workflow_id, workflow_name, step_name,
    operator_step_index, artifact, actions, started_at, paused_at}`
    for a single paused run. 404 if the run is unknown, 409 (with
    `error: not_operator_pause`) when paused for a different reason.

  - GET /api/workflows/operator/pending
    Worklist of every currently-paused operator run, oldest first,
    in the same row shape so the dashboard can reuse the renderer.

Both routes go through the normal auth middleware (NOT on the public
allowlist) — the authenticated operator is the security boundary, same
as the existing POST resolve endpoint. Neither is added to the curated
`openapi.rs` paths list, matching the convention used by
`operator_action_workflow_run` / `pause_workflow_run` /
`resume_workflow_run` / `cancel_workflow_run` / `get_workflow_run`,
so `openapi.json` does not need a regen.

`operator_pause_row_json` is centralised so the single-row inspector
and the worklist endpoint render byte-identical rows — the dashboard
caches by `run_id` and switching surfaces must never change the shape.

Integration tests (`workflow_operator_action_test.rs`, 12 total
including 4 new):

  - operator_http_inspect_returns_artifact_and_actions
  - operator_http_inspect_unknown_run_is_404
  - operator_http_inspect_non_operator_pause_is_409
  - operator_http_pending_lists_all_operator_paused_runs

All exercised via the real `workflows::router()` against `TestServer`.

Surfaces paused workflow runs awaiting operator review on the
Workflows page. Two new components, both backed by the new GET
endpoints landed in the previous commit:

  - `PendingOperatorReviewsBanner` — sits above the tabs; lists every
    operator-paused run across all workflows (oldest first) so the
    human operator lands on the page and immediately sees "N runs
    waiting." Clicking a row selects the workflow + run so the action
    bar inside the run detail panel is on screen.

  - `OperatorActionBar` — renders inside the run detail panel when the
    run state is `paused`. Shows the artifact preview and one button
    per authorised action (`OperatorAction`); payload-bearing verbs
    (Edit / FreeformInput / ProvideInput) expand into an inline
    textarea that submits via the existing `POST .../operator`
    resolve endpoint.

Data layer follows the dashboard rule: all reads through
`useWorkflowOperatorPause` / `usePendingOperatorRuns`
(`lib/queries/workflows.ts`); the write is `useResolveOperatorStep`
(`lib/mutations/workflows.ts`). Query keys live in the factory
(`workflowKeys.operatorAll/operatorPause/pendingOperator`). The
resolve mutation invalidates the inspect cache + worklist + run detail
+ all workflow lists on success so every surface picks up the
Paused→Running transition without a manual refetch.

The worklist polls every 15s in the foreground only (#3393 pattern).
The inspect query treats 404/409 as a stable "not pending" state
(does not retry) so non-operator paused runs render nothing rather
than a spinner.

WorkflowsPage tests extended (mocks for the new hooks + two new cases
covering the empty worklist + populated banner state). All 16
existing tests still pass.

…shboard cache invalidation

Three code-review follow-ups on PR #5257 (HITL operator-step
dashboard):

1. **Operator identity in audit trail** — `operator_action_workflow_run`
   previously only logged on `Err`; a successful approve / reject /
   edit emitted no event, so the audit trail had no record of WHO
   resolved a paused operator step. Added an optional
   `axum::Extension<AuthenticatedApiUser>` extractor (Option so the
   handler still compiles under auth-disabled installs; in production
   the auth middleware rejects unauthenticated callers before this
   point), captured the operator name + the action verb upfront, and
   added a structured `tracing::info!` on success with both fields.
   The existing `tracing::warn!` on failure now carries the same
   fields so an audit ship pipeline (SIEM tail) sees one event per
   operator decision, success or fail.

2. **Race documentation in apply_operator_outcome** — Operator click
   and timeout-watchdog firing the same instant is a real race
   window, but the state flip Paused → Running happens inside the
   `self.runs.get_mut(...)` critical section: only the first caller
   sees `is_paused() == true` and applies its outcome; the second
   gets a clean `Err(NotPaused)` and exits. So the existing code is
   idempotent. Added a doc-comment block above
   `cancel_operator_timeout_watchdog` explaining the
   critical-section guarantee so a future reader doesn't think the
   ordering needs to change.

3. **Scoped cache invalidation on `useResolveOperatorStep`** —
   `onSuccess` was invalidating `workflowKeys.all`, which cascades a
   refetch of every workflow list / template / unrelated run on the
   page. Narrowed to `operatorPause(runId)` + `operatorAll()` +
   `runDetail(runId)` — the three surfaces that actually change.
   Per CLAUDE.md "Use `.all` only when the mutation truly dirties
   every sub-key."

Also merged latest origin/main into the branch to pick up the
opentelemetry-stack alignment (#5279) so this branch compiles under
the default `telemetry` feature again.

Tests: `cargo check -p librefang-api -p librefang-kernel --lib`: clean.
`pnpm exec vitest run src/lib/mutations/workflows`: 9 passed.