Make Doctor receipts durable and scoped

[papi-ux]

What changed

• persist Doctor receipts by opaque exact host/session/app scope with bounded retention
• keep verification and Undo visible after the transient Snackbar or menu closes
• reject stale scope, run, generation, and menu completions
• bound both transient verification failures and total successful watching polls
• use host-provided action IDs and honor explicit permission/Undo revocation
• refresh exact scope and permission immediately before Undo
• prevent automatic retry or redirect replay of non-idempotent Doctor POSTs
• serialize apply, verification, and Undo with generation-owned in-flight state

Why

The release smoke proved Doctor verification and Undo were presentation-lifetime state. Once the Snackbar expired, Nova had no durable authenticated path to observe the result or restore the prior host state.

Validation

• full unit suite: 1,318 tests passed
• :app:lintNonRoot_gameDebug: passed against the existing baseline
• :app:assembleNonRoot_gameRelease: passed for all configured ABIs
• git diff --check: passed
• final independent adversarial review: PASS
• reviewed patch SHA-256: 57acb4a62530d19e95513f3c8354b7500d8167db31e8ea0cbeca4a98ddc8a083

The assembled APKs are unsigned build evidence, not release candidates. Physical RP6 validation remains deferred until this PR and the matching Polaris PR merge. No tag or release is authorized.