feat(switch-compat): hard verification gate — only manufacturer-verified switches show compatibility

A switch presents transceiver compatibility ONLY if ports_verified=true (its port
config confirmed against the manufacturer datasheet). Unverified switches return
NO suggestions rather than potentially-wrong data. New columns: ports_verified,
ports_verified_source, ports_verified_at. Verified so far against datasheets:
HPE Aruba CX 10000-48Y6C, NVIDIA SN3700 (corrected 100G->200G QSFP56), SN4700,
SN5400, SN5600. 262 switches still pending datasheet verification.

packages/api/src/db/queries.ts

@@ -346,6 +346,12 @@ export async function getFlexoptixSuggestions(switchId: string) {
          END AS vpat
        FROM switches s JOIN vendors v ON v.id = s.vendor_id WHERE s.id = $1
      ),
+     gate AS (
+       -- Hard gate: a switch only presents compatibility if its port config has
+       -- been verified against the manufacturer datasheet/source. Unverified =
+       -- no claim (return nothing) rather than show potentially-wrong data.
+       SELECT ports_verified FROM switches WHERE id = $1
+     ),
      switch_ports AS (
        -- Parse each ports_config key 'SPEED_FORMFACTOR' (e.g. '100G_QSFP28') into
        -- a numeric port speed (Gbps) + a cage family. Real transceivers are then
@@ -415,6 +421,7 @@ export async function getFlexoptixSuggestions(switchId: string) {
        LIMIT 1
      ) so ON true
      WHERE LOWER(v.name) = 'flexoptix'
+       AND (SELECT ports_verified FROM gate) IS TRUE
        -- Only parts confirmed in Flexoptix's live API catalog (have authoritative
        -- datasheet specs). Excludes phantom/misattributed parts not actually
        -- orderable from Flexoptix, and parts with no source-of-truth specs.