Feat: Essential-work aggregation subsystem + first reach tiles (T433621, MR 2/4)

Second stacked T433621 MR, on !159 (merged). Ships the reach aggregation subsystem and the first two reach tiles: interface messages translated (core-group TWN scan) and policy pages added (langlink-target creator check).

Subsystem: one items table (INSERT OR IGNORE only — a failed pass under-reports, never wipes) + scanner bookkeeping with an inclusive cursor that advances only on COMPLETE pagination; a shared continue-following fetch helper (null on ANY failure, never a partial set); an in-process scheduler mirroring the completion sweep (45s boot delay, 6h interval, re-entrancy guard, per-subject error isolation, 500ms politeness), with an ESSENTIAL_SCAN_DISABLED=1 kill switch.

Tile semantics: messages-translated counts one item per (core message, language) per linked account after linking — the core set is the full mcoffset-paginated enumeration (escapes the 500-cap), compared by title base on both sides (key-to-title is not mechanical: category_header vs Category header, pinned live); first post-link edit wins the timestamp structurally (oldest-first scan + UNIQUE key). policy-pages records the Five-pillars langlink target when created by ANY kit user (the decided reach definition; T433617's anchored ledger is the subset).

Privacy invariant: items carry a private username solely so production admin exclusions apply at query time; no items SELECT ever includes it.

Verified: fixture smokes (2-page continuations both APIs, non-core/source/qqq skipping, per-language attribution, self re-edit keeps first timestamp, failing page-2 leaves cursor untouched, 3-pass idempotency, policy creator gate case-normalized, both caching layers) + seeded read smokes in dev and production modes + boot smokes incl. the kill switch.

Closes T433621