feat: add store CRUD methods for submission/extraction/finding/evidence

Create/Get for submission (including the one legitimate status
transition — submission is not append-only, unlike the other three),
Create/GetLatest for extraction and evidence_package, Create for
finding plus ListCurrentFindings which applies the anti-join documented
in the migration (a finding referenced by another row's `supersedes`
is not "current").

Tested against real Postgres, including that the append-only trigger
still rejects UPDATE on evidence_package via this new code path, and
that ListCurrentFindings actually hides a finding once a correction
supersedes it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/store/evidence.go

@@ -0,0 +1,54 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"time"
+)
+
+// EvidencePackage ist das Ergebnis der Archivierung eines Beitrags:
+// Dossier-Pfad, Hash der kanonisierten Metadaten und RFC-3161-Token.
+// Append-only: siehe Migration.
+type EvidencePackage struct {
+	ID             string
+	SubmissionID   string
+	DossierPath    string
+	SHA256         string
+	TimestampToken []byte
+	CreatedAt      time.Time
+}
+
+// CreateEvidencePackage speichert ein EvidencePackage.
+func (s *Store) CreateEvidencePackage(ctx context.Context, submissionID, dossierPath, sha256Hex string, timestampToken []byte) (EvidencePackage, error) {
+	var e EvidencePackage
+	err := s.Pool.QueryRow(ctx, `
+		INSERT INTO evidence_package (submission_id, dossier_path, sha256, timestamp_token)
+		VALUES ($1, $2, $3, $4)
+		RETURNING id, submission_id, dossier_path, sha256, timestamp_token, created_at
+	`, submissionID, dossierPath, sha256Hex, timestampToken).Scan(
+		&e.ID, &e.SubmissionID, &e.DossierPath, &e.SHA256, &e.TimestampToken, &e.CreatedAt,
+	)
+	if err != nil {
+		return EvidencePackage{}, fmt.Errorf("store: create evidence package: %w", err)
+	}
+	return e, nil
+}
+
+// GetLatestEvidencePackage liefert das zuletzt erzeugte EvidencePackage
+// für einen Beitrag.
+func (s *Store) GetLatestEvidencePackage(ctx context.Context, submissionID string) (EvidencePackage, error) {
+	var e EvidencePackage
+	err := s.Pool.QueryRow(ctx, `
+		SELECT id, submission_id, dossier_path, sha256, timestamp_token, created_at
+		FROM evidence_package
+		WHERE submission_id = $1
+		ORDER BY created_at DESC
+		LIMIT 1
+	`, submissionID).Scan(
+		&e.ID, &e.SubmissionID, &e.DossierPath, &e.SHA256, &e.TimestampToken, &e.CreatedAt,
+	)
+	if err != nil {
+		return EvidencePackage{}, fmt.Errorf("store: get latest evidence package: %w", err)
+	}
+	return e, nil
+}