feat(t215): add admin order authorization

backend-api/internal/usecase/execution_result_service.go

@@ -285,6 +285,24 @@ func (service *ExecutionResultService) StoreCandidates(
 	if err != nil {
 		return false, internalExecutionResultFailure(err)
 	}
+	var readyEvent *domain.TaskEvent
+	if len(command.Candidates) > 0 {
+		eventID, err := service.ids.NewID()
+		if err != nil {
+			return false, internalExecutionResultFailure(err)
+		}
+		actorUserID := identity.UserID
+		actorDeviceID := identity.DeviceID
+		readyEvent = &domain.TaskEvent{
+			ID:            eventID,
+			TaskID:        identity.TaskID,
+			ActorUserID:   &actorUserID,
+			ActorDeviceID: &actorDeviceID,
+			Type:          "CANDIDATES_READY",
+			Message:       "candidates ready for admin confirmation",
+			OccurredAt:    now,
+		}
+	}
 	replayed, err := service.repository.StoreExecutionCandidates(
 		ctx,
 		service.write(identity, executionResultCandidatesOperation, requestHash, now),
@@ -297,6 +315,7 @@ func (service *ExecutionResultService) StoreCandidates(
 			ProvenanceJSON:     provenanceJSON,
 			CandidatesJSON:     candidatesJSON,
 			RecommendationJSON: recommendationJSON,
+			ReadyEvent:         readyEvent,
 			ReceivedAt:         now,
 		},
 	)