Post-ingestion Difference service

**Technical summary:**
After each ingestion run completes, a diff service needs to run against the current ingestion's articles, compare them to production, and classify each one as NEW, UNCHANGED, or CHANGED — then route them into the review queue or log them as needing no action.

**Background:**
The existing ingestion service (src/services/epmc.py → EPMCService.insert_articles_by_keyword) writes all data to staging. This new service runs as a second pass after that call returns. It does not modify the staging records — it only reads them, compares against production, and writes to pmc_review and epmc_audit_log.

**More details to add**