[Admin] Review changes and publish an atomic content snapshot

[troyscott]

Outcome

Provide a tailnet-only human approval step between source refresh and public publication.

Acceptance criteria

• Admin can inspect sources, differences, and affected chapters.
• Draft, approved, rejected, and published states are explicit.
• Publishing records the Git commit and manifest hash.
• Public readers see either the complete old or complete new snapshot.
• Rollback to the prior publication is documented and tested.