Pause resubmission toggle + remove Airtable re-push button

[EDRipper]

Summary

• adds a Super-Admin toggle in the admin panel (Stats tab) to pause the changes-needed -> unreviewed resubmit path, for clearing the review queue
• while paused: ProjectsService.update() rejects that transition with a 403, and the changes-needed slack DM (sent from first-pass review and fraud-review rejection) gets an extra note in Euan's words
• new app_settings key/value table (migration 1785300000000-CreateAppSettings) backs the toggle, exposed via GET/POST /api/admin/settings/resubmission-paused (get = any reviewer, set = Super Admin only, audit-logged)
• does not touch the separate "resubmit an already-approved project" flow (POST /projects/:id/resubmit), which is a voluntary re-ship, not the DM-driven changes-needed flow
• removes the "Re-push to Airtable" button from the approved-project review panel (and its now-dead JS/CSS); backend endpoint left in place, just unwired from the UI

Test plan

• npx tsc --noEmit (backend) clean
• npm run build (backend) clean
• npx jest (backend) - 93/93 passing, incl. updated admin-ban.spec.ts constructor mock
• npm run check (frontend) - only pre-existing errors/warnings in files not touched by this PR
• manually click the toggle in a deployed admin panel and confirm a changes-needed DM carries the note