fix: drop stale pending reviews and scope assignment toggle to super admins

[devin-ai-integration]

Summary

Audit of the review flow (submit → super-admin batch assign → admin vote → counters) against the "every submitted application gets reviews_per_application distinct reviews" guarantee. The core BatchAssign algorithm (least-pending-workload, self-review/duplicate exclusion, FOR UPDATE serialization, shortage reporting) holds up and the existing integration suite passes against a real Postgres. Three gaps found and fixed here, each reproduced first with a DB-backed test:

1. Pending reviews on decided applications lingered forever. setApplicationStatus (accepted/rejected/waitlisted) never touched application_reviews, so admins kept getting asked to vote on applications that were already decided, and that dead work counted toward their workload in balancing.

   • GetPendingByAdminID now adds AND a.status = 'submitted' so queues drop the app immediately.
   • BatchAssign cleanup now also deletes vote IS NULL rows whose application is no longer submitted (completed votes are kept). Counted in ReviewsRemoved.

2. A super admin who disabled their toggle and was then demoted to admin was excluded permanently. The toggle entry survived the demotion, BatchAssign honored it for any role, and PUT /superadmin/settings/review-assignment-toggle refuses non-super-admins — so nothing could re-enable them. The toggle is documented as super-admin-only, so BatchAssign now:

   • only treats an ID as disabled when u.role = 'super_admin' (both in the cleanup DELETE and the eligibility query);
   • prunes toggle entries for users who are no longer super admins when it rewrites the normalized setting.
     The existing completed_ineligible_reviews_preserved/false subtest toggled a plain admin via the store (unreachable through the API); it now promotes that user to super_admin first.

3. GET /admin/reviews/next (AssignNextForAdmin) ignored the toggle. A disabled super admin could still self-assign. The handler now checks GetReviewAssignmentToggle for super admins and returns 403. (The frontend doesn't call this endpoint; it's kept as-is otherwise.)

New integration subtests: decided_application_pending_reviews_removed, demoted_disabled_super_admin_becomes_eligible_admin; new handler test for the 403. docs/docs.go regenerated via swag.

Verified locally: gofmt -l . && go vet ./..., go test ./cmd/api/ ./internal/... with HARP_TEST_DSN pointing at a migrated Postgres 16 container (integration suite run 4× for the concurrency subtests).

Not changed (worth a product call): plain admin users cannot be paused from assignment at all — only super admins have a toggle.

Link to Devin session: https://app.devin.ai/sessions/2b5cee5221ca42eea043044ce117ba47
Open in Devin Desktop: https://app.devin.ai/desktop/session/2b5cee5221ca42eea043044ce117ba47?variant=devin
Requested by: @balebbae

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring