feat: add profile candidate review workflow

app/api/controllers/public_platform.py

@@ -1,4 +1,4 @@
-from typing import Any
+from typing import Any, Literal
 
 from fastapi import APIRouter, Depends, Header
 from pydantic import Field
@@ -22,6 +22,10 @@ class Cancellation(StrictPayload):
     reason: str = Field(default="user_cancelled", max_length=128)
 
 
+class CandidateDecisionPayload(StrictPayload):
+    decision: Literal["confirmed", "rejected"]
+
+
 @router.post("/conversations", status_code=201)
 async def create_session(
     payload: SessionCreate,
@@ -90,3 +94,27 @@ async def customer_memory(
     customer_id: int, context: RequestContext = Depends(build_request_context),  # noqa: B008
 ) -> dict[str, Any]:
     return await PublicPlatformService().memory(customer_id, context)
+
+
+@router.get("/users/me/memory-candidates")
+async def my_memory_candidates(
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
+) -> dict[str, Any]:
+    """返回当前用户可确认的画像候选，不返回证据原文。"""
+    from app.service.customer_profile_candidate_service import CustomerProfileCandidateService
+
+    return await CustomerProfileCandidateService().list_for_customer(context)
+
+
+@router.post("/users/me/memory-candidates/{candidate_id}/decisions")
+async def decide_memory_candidate(
+    candidate_id: int,
+    payload: CandidateDecisionPayload,
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
+) -> dict[str, Any]:
+    """用户确认或拒绝自己的候选；确认后仍需管理员审核才能激活。"""
+    from app.service.customer_profile_candidate_service import CustomerProfileCandidateService
+
+    return await CustomerProfileCandidateService().decide_by_customer(
+        candidate_id, payload.decision, context
+    )