Labels an identity as a store-review identity: from now on `POST /v1/keys` issues it a **verified, non-expiring** key rather than a provisional one, and sends no verification mail.

This is the whole of the App Review exemption. It exists because the MapMap Nav app has no sign-in. Its only route to a key is typing an email at first run, and a reviewer cannot click a verification link sent to an inbox nobody gave them, so without it a reviewer can use the app online but cannot install an offline territory, which is the capability the store listing leads with. See migrations/0034_reviewer_identity.sql for the full reasoning and the residual risk, and docs/RUNBOOK-APP-REVIEW.md for the procedure.

Deliberately NOT a config flag. It is one named row, it carries a written reason, it is listed by GET /admin/identities/reviewer, every key issued against it logs at WARN, and DELETE revokes it. No other identity's behaviour changes, and verification is not weakened for anybody.