feat(22-01): implement deriveDefaultParams for the 7 remediation action types

- Pure switch over no_action/warn_user/block_sender/purge_message/
  reset_password/isolate_endpoint/disable_forwarding_rule
- Unknown/future action types fall through to {} rather than throwing

lib/services/remediation-default-params.ts

@@ -0,0 +1,42 @@
+/**
+ * Remediation Default-Params Derivation (Phase 22, Wave 0)
+ *
+ * Pure transform: given an action type (from campaign-classifier.ts's
+ * `mapVerdictToActions` vocabulary) and bounded evidence fields, returns the
+ * default `params` object an operator sees pre-filled in the Action Area
+ * before approving (feeds `ApproveActionInput.params` in
+ * lib/services/remediation-service.ts). No DB/fetch imports — pure function.
+ */
+
+export interface DefaultParamEvidence {
+  requesterEmail: string | null;
+  senderEmail: string | null;
+  senderDomain: string | null;
+  messageId: string | null;
+}
+
+/**
+ * Exhaustive per-action-type default-params table (UI-SPEC Action Area
+ * Spec). Unknown/future action types fall through to `{}` rather than
+ * throwing, so newly introduced action types never break the Action Area.
+ */
+export function deriveDefaultParams(actionType: string, evidence: DefaultParamEvidence): Record<string, unknown> {
+  switch (actionType) {
+    case 'no_action':
+      return {};
+    case 'warn_user':
+      return { recipientEmail: evidence.requesterEmail ?? '', message: '' };
+    case 'block_sender':
+      return { senderEmail: evidence.senderEmail ?? '', senderDomain: evidence.senderDomain ?? '' };
+    case 'purge_message':
+      return { messageId: evidence.messageId ?? '', mailboxes: [] };
+    case 'reset_password':
+      return { userPrincipalName: evidence.requesterEmail ?? '' };
+    case 'isolate_endpoint':
+      return { deviceId: '' };
+    case 'disable_forwarding_rule':
+      return { userPrincipalName: evidence.requesterEmail ?? '', ruleName: '' };
+    default:
+      return {};
+  }
+}