feat(23-03): add phishing_automation_gate migration 100

- Opt-in per-company table (auto_parse/auto_classify/auto_report, all default false)
- PK company_id -> companies(id) ON DELETE CASCADE, updated_by/updated_at audit cols
- Applied to running dev Postgres (existing volume, not auto-run on init)

migrations/100_phishing_automation_gate.sql

@@ -0,0 +1,28 @@
+-- =============================================================================
+-- Phishing automation gate table
+-- =============================================================================
+-- Controls whether the phishing triage pipeline's parse/classify/report-to-ticket
+-- stages run automatically for a given Autotask company, or require the existing
+-- manual Analyze/Classify/triage-note triggers.  Opt-IN model (opposite polarity
+-- from company_scope): companies without a row here have all three stages OFF.
+--
+-- auto_parse     — automatically extract/parse .eml evidence on detection
+-- auto_classify  — automatically run campaign classification after parsing
+-- auto_report    — automatically post the acknowledge_user note ONLY for
+--                  USER_AWARENESS verdicts (D-04); never a general "auto-post
+--                  any note/action" gate. All other verdicts/actions still
+--                  require manual approval via the existing review UI even
+--                  when auto_report is enabled for the company.
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS phishing_automation_gate (
+  company_id     BIGINT       PRIMARY KEY REFERENCES companies(id) ON DELETE CASCADE,
+  auto_parse     BOOLEAN      NOT NULL DEFAULT false,
+  auto_classify  BOOLEAN      NOT NULL DEFAULT false,
+  auto_report    BOOLEAN      NOT NULL DEFAULT false,
+  updated_by     TEXT,
+  updated_at     TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+COMMENT ON TABLE phishing_automation_gate IS
+  'Opt-in per-company phishing pipeline automation gate. Absent row = all three stages OFF (manual-only). auto_report auto-posts ONLY the acknowledge_user action for USER_AWARENESS verdicts (D-04) -- it never auto-posts any other action.';