Build brand verification Admin2 review dashboard

[Ty Giacalone (ty-whatnot)]

Background

Adds the restricted manual review surface described in the Brand Badging PRD.

Changes

• Adds a query-fed review queue with applicant, KYB, trademark, revenue, and eligibility details.
• Validates query data at a dedicated adapter boundary and accepts only taxIdLastFour, so a full EIN/TIN never enters Retool component state or the browser.
• Exposes backend-agnostic approve and reject events through Retool, with required rejection reasons.
• Hides sensitive details behind a reviewer permission binding as defense in depth; the upstream query and decision mutations must enforce reviewer authorization.

Testing

Covers unauthorized access, approval submission, required rejection reasoning, sensitive-data contract enforcement, malformed query records, unsafe external URLs, queue filtering, keyboard dialog behavior, and Retool event ordering. Verified TypeScript, all 10 tests, and the production build locally.

Screenshots

Rejected decision submitted

🤖 Assisted by Codex.