Two issues from the whole-branch review:
1. (Important) Observation detail's can_respond_to_department context var
did not include is_department_manager, so even though Task 2 let dept
managers pass the view's permission check, the 'Submit Response'
button stayed hidden from them. Now the context var matches the view
predicate. Regression test added.
2. (Minor) appreciation_list had no guard against now-invalid status
query params (?status=acknowledged from an old bookmark would show
an unexplained empty list). Unknown values are now silently reset
to 'all statuses'.
