feat: ADR-0006 §8 steps 4-5 — undo/redo commands + confirm-modal flow

Commands & grammar (step 4):
- AppCommand::Undo/Redo, grammar nodes + REGISTRY entries, catalog
  help/usage + keys; parse tests
- replay skips undo/redo (is_app_lifecycle_entry_word) + completion
  entry-keyword lockstep; replay-skip test extended

Wiring (step 5):
- Action::{PrepareUndo,PrepareRedo,Undo,Redo} + AppEvent::{UndoPrepared,
  UndoUnavailable,UndoSucceeded,UndoFailed}
- App: undo_enabled flag, Modal::UndoConfirm, dispatch + event handling
  + confirm-key handler (Y confirms / N/Esc cancels); "turned off" when
  --no-undo; "nothing to undo/redo" when empty
- ui::render_undo_confirm names the command + snapshot time
- runtime: opens with undo enabled (!--no-undo), threads it through the
  project-switch path, spawn_prepare_undo/spawn_undo (peek->modal,
  restore->refresh tables + schema cache)
- 9 Tier-1 app tests + 3 parse tests

1692 passed / 0 failed / 1 ignored; clippy clean.

src/action.rs

@@ -109,4 +109,17 @@ pub enum Action {
     Replay {
         path: String,
     },
+    /// User issued `undo` (`PrepareUndo`) or `redo` (`PrepareRedo`)
+    /// (ADR-0006 Amendment 1). The runtime peeks the snapshot the
+    /// command would restore and posts `AppEvent::UndoPrepared`
+    /// (opening the confirmation modal) or `AppEvent::UndoUnavailable`
+    /// (nothing to undo/redo). Only emitted when undo is enabled —
+    /// the `App` notes "undo is off" itself under `--no-undo`.
+    PrepareUndo,
+    PrepareRedo,
+    /// User confirmed `undo` / `redo` from inside the modal. The
+    /// runtime restores the snapshot through the worker, then
+    /// refreshes the table list + schema cache.
+    Undo,
+    Redo,
 }