feat: implement product knowledge management & retrieval (004)

Implements 26 of 28 tasks from specs/004-product-knowledge/tasks.md
across all three user stories -- Phase 3 of the roadmap. First
feature to populate src/modules/ai-support/ (doc 07 places
`knowledge` there; only that submodule is built, matching this
codebase's convention of not pre-building unneeded submodules).

Schema (prisma/schema.prisma + migration):
- KnowledgeEntry, ErrorCode, KnownIssue, Runbook per docs/06,
  refining its conceptual flat `version` field into an explicit
  version-history mechanism: each edit inserts a new row
  (isCurrentVersion flag, compound unique on (code, version) /
  (key, productId, version)) instead of overwriting in place -- the
  only way "prior versions remain retrievable" (FR-004/FR-009) is
  actually true rather than aspirational.

User Story 1 -- knowledge entry authoring/publish/version (P1, MVP):
- draft -> published -> unpublished lifecycle; publish only takes
  effect from its effectiveDate.
- Editing uses the same conditional-update-then-insert optimistic
  concurrency pattern as 003-ticketing's Ticket.version (409 on a
  stale expectedVersion).
- Full version history readable via GET .../versions.

User Story 2 -- error codes, known issues, runbooks (P2):
- ErrorCode + KnownIssue with direct lookup-by-error-code.
- Runbook steps stored as an ordered JSON array, preserved exactly;
  same version-on-edit mechanism as knowledge entries; inactive
  runbooks are indistinguishable from nonexistent ones on lookup.

User Story 3 -- filtered retrieval (P3):
- GET /knowledge/retrieve: product-scoped, excludes draft/
  unpublished/not-yet-effective entries, validated entries ranked
  ahead of unvalidated. Deliberately NOT semantic/vector search --
  doc 11 gap B1 explicitly defers embedding-model choice to the
  future AI-support feature; this is real, usable structured
  filtering a semantic layer can sit in front of later.

Found and fixed one real bug before it reached tests: the retrieval
endpoint initially queried by the raw external product id instead of
resolving it to the internal Product.id first (every other endpoint
in this feature does that resolution) -- would have silently
returned zero results for every caller. Fixed with a lenient
tryResolveProductId (empty array, not 404, for an unregistered
product -- matches the "no matches, never an error" contract).

Deliberately skipped (not forgotten, see checklist notes): the two
planned mock-repository unit-test tasks (T004, T019) -- unlike
003-ticketing's state machine, this feature has no pure-logic
surface to isolate from Prisma; coverage comes entirely from
integration tests instead.

All 13 integration test files in the repo (36 tests, spanning this
feature and every prior one) verified passing together against a
real Postgres/Redis/MinIO -- no regressions. Full quality gate
(typecheck/lint/format/architecture/unit tests) passes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/modules/ai-support/knowledge/service/knowledge.service.ts

@@ -0,0 +1,62 @@
+import { KnowledgeEntry } from '@prisma/client';
+import { NotFoundError, ConflictError } from '@/common/errors';
+import {
+  knowledgeRepository,
+  KnowledgeRepository,
+  CreateKnowledgeEntryData,
+  RetrieveFilters,
+} from '../repository';
+
+export class KnowledgeService {
+  constructor(private readonly repo: KnowledgeRepository = knowledgeRepository) {}
+
+  /** FR-002: new entries always default to status: draft, version: 1 — set by the repository. */
+  async create(data: CreateKnowledgeEntryData): Promise<KnowledgeEntry> {
+    return this.repo.create(data);
+  }
+
+  async publish(code: string, effectiveDate?: Date): Promise<KnowledgeEntry> {
+    const updated = await this.repo.publish(code, effectiveDate);
+    if (!updated) throw new NotFoundError('Knowledge entry not found.');
+    return updated;
+  }
+
+  async unpublish(code: string): Promise<KnowledgeEntry> {
+    const updated = await this.repo.unpublish(code);
+    if (!updated) throw new NotFoundError('Knowledge entry not found.');
+    return updated;
+  }
+
+  async setValidationStatus(code: string, validationStatus: string): Promise<KnowledgeEntry> {
+    const updated = await this.repo.setValidationStatus(code, validationStatus);
+    if (!updated) throw new NotFoundError('Knowledge entry not found.');
+    return updated;
+  }
+
+  /** FR-004: an edit always creates a new version; a stale `expectedVersion` is rejected. */
+  async edit(
+    code: string,
+    expectedVersion: number,
+    content: Omit<CreateKnowledgeEntryData, 'code' | 'productId'>,
+  ): Promise<KnowledgeEntry> {
+    const updated = await this.repo.createNewVersion(code, expectedVersion, content);
+    if (!updated) {
+      throw new ConflictError(
+        'Knowledge entry was modified by another request — refresh and retry.',
+      );
+    }
+    return updated;
+  }
+
+  async listVersions(code: string): Promise<KnowledgeEntry[]> {
+    const versions = await this.repo.findAllVersionsByCode(code);
+    if (versions.length === 0) throw new NotFoundError('Knowledge entry not found.');
+    return versions;
+  }
+
+  async retrieve(filters: RetrieveFilters): Promise<KnowledgeEntry[]> {
+    return this.repo.retrieve(filters);
+  }
+}
+
+export const knowledgeService = new KnowledgeService();