fix(purchase): the fire sweep overwrites approved_by with "scheduler" #1589

FireScheduledDelayedPurchases (internal/purchase/scheduled_fire.go) stamps ApprovedBy = "scheduler" when it fires a delayed purchase, replacing the email of the person who approved it. Every delayed approval (purchase_delay_hours > 0) loses its approver in purchase_executions and in what History shows. #1580 turned the sweep on by default, so this now happens on every install that sets a delay. The migrated default is 0, which executes approvals immediately and isn't affected.

Fix: keep the approver's identity in approved_by and record that the scheduler fired it in a separate field or audit event. Add a test that fires a delayed approval and checks the approver is kept.

Found in review of #1580. The behavior predates #1580.