#505 decision log: record the resolving auth path and whether a human answered

[Anonymous]

Originally created by: fu351

auth_result means different things per writer: the MCP proxy stores the tier or approval-method name (soft_confirm, local_auth, <method>), the host hooks store only executed/blocked, and the turn gate stores a label. Nothing records whether a human actually answered a challenge or it was resolved by approval memory, a dev auto-deny, or a host-hook allow. Add two nullable columns to decisions (additive CREATE TABLE IF NOT EXISTS + migration guard, matching how storage/db.py adds columns): auth_path (which code path resolved it) and human_confirmed (bool). Populate from every writer listed above; surface both in doberman log --json. Tests: one per writer path, plus a redaction check that neither column can carry command text.