[P1] Wire the room learner capture, model lifecycle and protected managed-server API #2421

Parent plan: #2418

Scope

Integrate the final learner into the managed sensing server: explicit capture phases, source windows, typed training job, evaluation, private candidate persistence and separate model adoption. Preserve the current detector as control until qualification.

Acceptance

• Protected versioned API and actual ingestion caller support begin/capture/seal/train/status/cancel/evaluate/store/load without accepting client-supplied scores as measured evidence.
• Backend reports the real algorithm, trained/scored sources, phase, progress, constraints and rejection reasons.
• Atomic account/installation/room-bound persistence, bounded schema/integrity, private permissions and safe restart loading.
• Failed training, cancellation, stale/wrong-context candidates, disk failure and corruption never replace a working accepted model or erase history.
• Authentication refresh preserves capture/model state; logout closes access without deleting account records.
• Adoption is distinct from training completion and requires the agreed independent qualification; no automatic authority from feat(calibration): opt-in per-source FieldModel shadow bank #2417.
• Composed HTTP/ingestion/train/cold-load/inference and negative tests pass; standalone primitives alone do not close this issue.