Recover pending token settlements after database failures

Reproduced: after successful paid inference, three database settlement failures leave customer funds pending with no automatic retry path.

Persist the numeric settlement decision in Postgres before applying it, then atomically settle and remove the queued record. The existing scheduled worker retries up to 100 queued settlements per run without double charging or refunding unknown outcomes.

• Add a preview-only reconciliation command: bun scripts/reconcile-token-reservations.ts. An explicit --refund REQUEST_ID releases an unjournaled, unreviewed token hold older than 24 hours; this intentionally waives any unknown charge for that request.
• Existing holds are not automatically released. If all journal writes fail, or execution ends before the intent is saved, manual reconciliation is still required.
• Migration 0018_token_settlement_recovery.sql must run before the Worker, as the deployment workflow already does. No production balances were changed.

Visual evidence is not applicable: backend settlement and operator CLI only.