Re-evaluate incident severity on link, stamp resolved_at at every resolution site

#17: severity was written once at _create_incident and never touched again,
so an incident that opened routine and escalated to a working fire stayed
routine forever. _update_incident now merges call_severity into the incident
via _max_severity() on every link.

Severity is monotonic: it only ever rises, never falls. An incident briefly
assessed "major" genuinely was major at that moment; a later, calmer-sounding
call is evidence the situation is winding down, not that the earlier read was
wrong. status/resolved_at exist to retire an incident — severity should stay
as the high-water mark so the worst-first rail, "Major only" filter, and map
colouring never bury a call that was genuinely major. See _max_severity's
docstring in incident_correlator.py for the full argument.

#18: none of the resolution sites wrote resolved_at, so an incident's
lifespan couldn't be reconstructed for the history-scrub feature. Added
resolved_at alongside status="resolved" at all six sites that flip it:
  - incident_correlator.py _update_incident (signal-based: units all cleared)
  - incident_correlator.py maybe_resolve_parent (master auto-resolve)
  - summarizer.py _stale_sweep (90-minute auto-resolve)
  - upload.py, both scene-resolution loops (single- and multi-scene)
  - calls.py reprocess/correction path
(_update_incident's signal-resolve and maybe_resolve_parent's master-resolve
weren't named in the issue's four call sites, but they set status the same
way and were missing resolved_at too.)

No backfill: existing resolved incidents keep resolved_at = null, which
means "resolved before this field existed," not "never resolved." Backfilling
from updated_at would be a guess dressed up as data.

Tests: added to tests/test_correlator_gate.py, which needs no Firestore for
the pure _max_severity cases and patches fstore for the _update_incident/
maybe_resolve_parent writes. Covers the escalation case (routine -> major),
the no-downgrade case, and resolved_at on both the signal-resolve and
master-resolve paths. 52/52 passing in that file; 83 passed / 10
pre-existing failures for drb-c2-core overall (baseline was 69/10 — the
+14 is exactly the new tests, no regressions).

Fixes #17, #18.

drb-c2-core/app/routers/calls.py

@@ -173,6 +173,7 @@ async def patch_transcript(
                 await fstore.doc_set("incidents", old_incident_id, {
                     "call_ids": [],
                     "status": "resolved",
+                    "resolved_at": datetime.now(timezone.utc).isoformat(),
                     "summary_stale": True,
                 })
     await fstore.doc_set("calls", call_id, {"incident_ids": [], "incident_id": None})

drb-c2-core/app/routers/upload.py

@@ -1,4 +1,5 @@
 from typing import Optional
+from datetime import datetime, timezone
 from fastapi import APIRouter, BackgroundTasks, UploadFile, File, Form, HTTPException, Security
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from app.internal.storage import upload_audio
@@ -202,7 +203,10 @@ async def _run_extraction_pipeline(
         if incident_id and incident_id not in incident_ids:
             incident_ids.append(incident_id)
         if scene["resolved"] and incident_id:
-            await fstore.doc_set("incidents", incident_id, {"status": "resolved"})
+            await fstore.doc_set("incidents", incident_id, {
+                "status": "resolved",
+                "resolved_at": datetime.now(timezone.utc).isoformat(),
+            })
             await incident_correlator.maybe_resolve_parent(incident_id)
             logger.info(f"Auto-resolved incident {incident_id} (LLM closure detection)")
 
@@ -305,7 +309,10 @@ async def _run_intelligence_pipeline(
             if incident_id and incident_id not in incident_ids:
                 incident_ids.append(incident_id)
             if scene["resolved"] and incident_id:
-                await fstore.doc_set("incidents", incident_id, {"status": "resolved"})
+                await fstore.doc_set("incidents", incident_id, {
+                    "status": "resolved",
+                    "resolved_at": datetime.now(timezone.utc).isoformat(),
+                })
                 await incident_correlator.maybe_resolve_parent(incident_id)
                 logger.info(f"Auto-resolved incident {incident_id} (LLM closure detection)")