Require approval workflow for administrative escrow overrides

[mikewheeleer]

Summary

High-impact overrides should not be executable by one unreviewed request.

Why this matters

This closes a correctness, security, or operability gap in the TalentTrust backend and makes the behavior explicit under retries, chain inconsistency, authorization, and failure.

Requirements

• Repository scope: Talenttrust/Talenttrust-Backend only.
• Create requested, approved, rejected, and applied states; require separate approver identity; expire stale approvals and audit every transition.
• Preserve tenant isolation, structured errors, auditability, and existing API compatibility unless this issue explicitly requires a contract change.
• Add focused unit and integration coverage for the new behavior.

Technical guidance

• Follow the repository's existing service, queue, persistence, logging, authentication, and error-envelope conventions.
• Keep side effects bounded and make retries, ordering, authorization, and failure handling explicit.
• Document non-obvious operational and security decisions in the PR.

Edge cases — each must have a test

• request by operator
• self-approval
• expired request
• rejected request
• apply twice

Acceptance criteria

• Every requirement and edge case above is implemented and tested
• Unit and integration tests cover success, failure, retry, authorization, and boundary paths
• Existing tests pass with no regressions
• Errors and logs are structured and do not leak secrets or internal stack details
• npm run lint, npm test, and npm run build passes locally
• Code follows existing conventions with no duplication or dead code
• Documentation or concise comments explain non-obvious decisions
• PR description explains the approach, includes test evidence and security notes, and references Closes #

Out of scope

• multi-party governance voting

[gracepeterfejokwu]

@gracepeterfejokwu has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello maintainer I can work on this issue
please can you assign me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @gracepeterfejokwu to this issue.

[drips-wave]

Congratulations, @gracepeterfejokwu! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @gracepeterfejokwu: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊