[Improvement]: Comments: resolve / reopen threads

Parent PRD

#783

What to build

Add thread-level resolve / reopen to comments. Introduce nullable resolved_at (timestamptz) and resolved_by (string) fields on the comments table, orthogonal to the existing ACTIVE/DELETED status. Resolution operates on a root comment only (parent_id IS NULL; replies cannot be resolved independently — the parent_id column arrives with slice #THREAD but resolve/close ships against roots regardless and is forward-compatible). Add resolve/reopen endpoints under the existing comments feature permission. Permission to resolve/reopen is stricter than general comment-write: thread author, an active business owner of the entity, or an admin (owner lookup reuses BusinessOwnersManager.get_owners_for_object). Each transition writes one user-action audit entry and emits one change-log/system entry into the unified timeline. Frontend renders a resolved root collapsed with a "Resolved by X" badge and adds a filter chip to show/hide resolved threads inline (no separate tab) on both the sidebar and embedded timeline variants.

See PRD sections "Solution" (resolve/close), "Implementation decisions" (resolve/close model), and user stories 12–17.

Acceptance criteria

• Migration adds nullable resolved_at and resolved_by, orthogonal to status
• Resolve sets both fields; reopen nulls both; round-trip works
• Resolve/reopen allowed for thread author, active entity business owner, or admin; a non-owner writer is rejected
• Attempting to resolve a reply (non-root) is rejected
• Each resolve/reopen writes exactly one audit entry and one timeline system entry at the correct chronological position
• Resolved root renders collapsed with a "Resolved by X" badge on sidebar and embedded variants
• Filter chip shows/hides resolved threads inline; resolved threads are not moved to a separate tab
• Pytest (route + manager) covers permission matrix (author/owner/admin allow, non-owner deny), round-trip, non-root rejection, audit + timeline emission (owner lookup + notifications mocked)

Blocked by

None — can start immediately.

User stories addressed

12, 13, 14, 15, 16, 17

Start with the existing comments feature endpoints and route/manager pytest coverage, then read the permission path using BusinessOwnersManager.get_owners_for_object. Trace the sidebar and embedded timeline variants for resolved-thread rendering and filtering. Done means the migration, permission matrix, root-only round-trip, audit and timeline entries, and both frontend variants satisfy the listed acceptance criteria.