feat(sp14): 5-lane Inbox UI with Payer-Rejected acknowledge action

Closes the gap between the SP10 backend (5 lanes) and the SP6
frontend (4 lanes). The Payer-Rejected lane (277CA STC A4/A6/A7)
is now rendered alongside Rejected/Candidates/Unmatched/Done,
with an Acknowledge bulk action that drops claims from the
working surface without erasing the original 277CA rejection
event (audit log stays intact, SP11).

Backend:
* Migration 0010: add payer_rejected_acknowledged_at +
  payer_rejected_acknowledged_actor columns + partial index.
* db.py: surface the two new columns on the Claim model.
* inbox_lanes.py: filter acknowledged claims out of the
  payer_rejected lane; expose the new fields on the row payload
  for forward-compat (e.g. a future 'Recently acknowledged' view).
* api.py:
  - POST /api/inbox/payer-rejected/acknowledge
    Bulk-acknowledge. Idempotent. Returns transitioned /
    already_acked / not_found / not_rejected counts so the UI
    can show '3 of 5 were already acknowledged' on a noop bulk.
    Writes a 'claim.payer_rejected_acknowledged' event to the
    SP11 hash-chained audit log.
  - GET /api/inbox/export.csv: accept 'payer_rejected' lane.
* test_acks.py: bump user_version assertion to 10.
* test_lane_filter_acknowledged.py: 4 tests for the lane filter
  and forward-compat row payload.
* test_payer_rejected_acknowledge.py: 6 tests for the endpoint
  (happy path, idempotency, no-op on non-rejected, missing
  ids, 400 on empty, audit-log wiring + chain integrity).

Frontend:
* lib/inbox-api.ts: add payer_rejected to InboxLanes, add
  acknowledgePayerRejected(), update exportInboxCsvUrl union.
* hooks/useInboxLanes.ts: add payer_rejected to initial state.
* hooks/useInboxLanes.test.ts: add payer_rejected to mocks.
* components/inbox/BulkBar.tsx: add 'payer_rejected' lane with
  Acknowledge action (no Resubmit, no Dismiss — payer-rejected
  is not eligible for either).
* components/inbox/BulkBar.test.tsx: add payer_rejected test.
* pages/Inbox.tsx: render the 5th lane, hook up onAcknowledge,
  include payer_rejected in the needEyes count.
* pages/Inbox.test.tsx: 3 new tests (5-lane render, need-eyes
  count, acknowledge action hits the right endpoint).
* components/inbox/InboxHeader.tsx: doc comment now explains
  why payer_rejected rolls up into need-eyes.

Pre-existing typecheck warnings in BulkBar.test.tsx / InboxRow
.test.tsx / Lane.tsx / download.test.ts are unchanged from
main — not touched here.

Test counts: backend 724 -> 734 (+10). Frontend 350 -> 354 (+4).

src/lib/inbox-api.ts

@@ -1,9 +1,13 @@
 // ---------------------------------------------------------------------------
 // Inbox API client (sub-project 6).
 //
-// Mirrors the four-lane working surface: rejected / candidates / unmatched /
-// done_today. Plus the actions: manual match, dismiss, resubmit, export.
-// All non-2xx responses throw (so callers can branch on status).
+// Mirrors the five-lane working surface: rejected / payer_rejected /
+// candidates / unmatched / done_today. Plus the actions: manual match,
+// dismiss, resubmit, acknowledge, export. All non-2xx responses throw
+// (so callers can branch on status).
+//
+// SP14: added the `payer_rejected` lane (277CA STC A4/A6/A7) and the
+// `acknowledge` action — distinct from the 999 envelope `rejected` lane.
 // ---------------------------------------------------------------------------
 
 export type ScoreBreakdown = {
@@ -39,6 +43,17 @@ export type InboxClaimRow = {
     matched_lines: number;
     total_lines: number;
   } | null;
+  // SP10/SP14: payer-side rejection fields. Populated on the
+  // `payer_rejected` lane with the 277CA STC category, reason,
+  // and source 277CA id. The ack fields are always null on the
+  // lane (we filter acknowledged claims out) but exposed for
+  // forward-compat.
+  payer_rejected_at?: string | null;
+  payer_rejected_reason?: string | null;
+  payer_rejected_status_code?: string | null;
+  payer_rejected_by_277ca_id?: string | null;
+  payer_rejected_acknowledged_at?: string | null;
+  payer_rejected_acknowledged_actor?: string | null;
 };
 
 export type InboxCandidateRow = {
@@ -59,6 +74,8 @@ export type InboxCandidateRow = {
 
 export type InboxLanes = {
   rejected: InboxClaimRow[];
+  /** SP14: 277CA STC A4/A6/A7 — payer-side rejection, distinct from 999. */
+  payer_rejected: InboxClaimRow[];
   candidates: InboxCandidateRow[];
   unmatched: InboxClaimRow[];
   done_today: InboxClaimRow[];
@@ -173,7 +190,38 @@ export async function resubmitRejectedWithDownload(
 }
 
 export function exportInboxCsvUrl(
-  lane: "rejected" | "candidates" | "unmatched" | "done_today",
+  lane:
+    | "rejected"
+    | "payer_rejected"
+    | "candidates"
+    | "unmatched"
+    | "done_today",
 ): string {
   return joinUrl(`/api/inbox/export.csv?lane=${lane}`);
 }
+
+// ---------------------------------------------------------------------------
+// SP14: Payer-Rejected acknowledge
+//
+// Marks the listed claims as acknowledged by the operator. Acknowledged
+// claims drop out of the Payer-Rejected Inbox lane. The original 277CA
+// rejection event stays in the audit log (SP11) — we only flip a
+// working-surface flag.
+// ---------------------------------------------------------------------------
+export type AcknowledgeResult = {
+  ok: boolean;
+  transitioned: number;
+  already_acked: number;
+  not_found: number;
+  not_rejected: number;
+};
+
+export async function acknowledgePayerRejected(
+  claimIds: string[],
+  actor: string = "operator",
+): Promise<AcknowledgeResult> {
+  return postJson<AcknowledgeResult>(
+    "/api/inbox/payer-rejected/acknowledge",
+    { claim_ids: claimIds, actor },
+  );
+}