V2-S2: Post-submission Safety Review with hazard linkage and risk dispositions

- Add risk_dispositions table (report_id + hazard_id unique, disposition enum,
  rationale, assessed_risk_id, reviewer_id) and reports.disposition_due_at SLA timer
- Add RiskDisposition domain enum with rationale-required validation (no_further_ra)
- Add RiskDisposition model and RiskDispositionService (record, forReport)
- Add ReportController actions: linkHazard (link existing or atomically create
  new hazard with reference), storeDisposition (records disposition + notifies),
  conductRiskAssessment (redirects to prefilled risks.create with hazard/source)
- Report show() now loads linked hazards, dispositions, disposition options, canReview
- Add StoreReportHazardRequest and StoreRiskDispositionRequest with permission checks
- RiskAssessmentController.create() passes source_type/source_id for pre-population
- Add Safety Review section in Reports/Show.tsx: linked hazards list, link/new hazard
  form, disposition form, Conduct Risk Assessment action
- Add RiskDisposition TS type and routes with hazard.create/risk.edit/risk.create middleware
- Add 5 Pest tests (link new/existing hazard, disposition validation, redirect, permission guard)
- Update IMPLEMENTATION_PLAN_V2.md: WS-3 marked complete
