Referral Reward Tick

Referral reward APPROVALS (#98). Never pays anything.

• Engineer referrals: Pending → Approved once the placement is Active, past the day-60 gate (30 for grandfathered rows) and its first invoice is paid.
• Client referrals (v2, $5,000): creates the two tranches as Pending and approves each when earned ($2,500 first invoice paid; $2,500 day 90 active with 3 invoices paid).

Payout stays manual while Stripe is frozen. Advisory-locked and every write is conditional, so a re-run approves nothing twice. Called daily by .github/workflows/bench-freshness-cron.yml.