fix(l1): resolve PR #193 backend review findings (1,4,5,6,7,8,9,10)

Server-assigns a uuid4 id to every AI-generated node (Finding 1 showstopper:
nodes had no id but the advance protocol keys on node_id, so ai_build walks
never advanced past question 1). Replaces the hidden {"node_type":"meta"}
walked_path convention with real category/problem_text/pending_node columns on
l1_walk_sessions (migration 61dda4f615c6) — fixes junk proposals + off-by-one
depth cap (Findings 8,9), and pending_node replays the served node on re-mount
(no duplicate paid LLM call). Intake honors explicit flow_id and adhoc=True
(Findings 4,5); flow_proposals.l1_session_id FK -> CASCADE (Finding 6 time
bomb); L1 category GET is owner+admin like PATCH and require_account_owner_or_admin
delegates to User.can_manage_account (Finding 7); escalate falls back to default
recipients + filters deleted_at + warns when empty (Finding 10). Cleanups: dead
ticket_ref removed, IntakeResponse per-outcome validator, unused acknowledged
dropped, escalations partial index, restored a deleted audit assertion.

Full Phase 2A backend set: 110 passed / 0 failed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/app/models/flow_proposal.py

@@ -86,7 +86,13 @@ class FlowProposal(Base):
     )
     l1_session_id: Mapped[Optional[uuid.UUID]] = mapped_column(
         UUID(as_uuid=True),
-        ForeignKey("l1_walk_sessions.id", ondelete="SET NULL"),
+        # CASCADE, not SET NULL: the exactly-one-source CHECK below means an
+        # L1-sourced proposal has source_session_id NULL by construction, so a
+        # SET NULL on l1_session deletion would NULL both columns and the
+        # non-deferrable CHECK would abort the DELETE — making any L1 session
+        # referenced by a proposal undeletable (hard_delete_user, GDPR purge).
+        # The proposal dies with its source, matching source_session_id's CASCADE.
+        ForeignKey("l1_walk_sessions.id", ondelete="CASCADE"),
         nullable=True,
         index=True,
     )