Sync FP submission lifecycle_status from Ivanti currentState on fetch

When GET /submissions enriches submissions with Ivanti API data, it now
checks if batch.currentState (APPROVED, REJECTED, REWORK) differs from
the local lifecycle_status and updates the DB accordingly. This ensures
approved submissions get filtered out of the queue panel as intended.

Also changed safeText() to return null for non-string Ivanti note values
(arrays/objects) instead of JSON-stringifying them. The notes array
filters nulls via .filter(Boolean) so non-string data is simply hidden.

backend/routes/ivantiFpWorkflow.js

@@ -302,6 +302,22 @@ function createIvantiFpWorkflowRouter() {
                             }
                         }
                     } catch (e) { console.error('Error enriching submissions with Ivanti notes:', e.message); }
+
+                    // Sync lifecycle_status from Ivanti currentState when it differs
+                    const STATE_MAP = { 'APPROVED': 'approved', 'REJECTED': 'rejected', 'REWORK': 'rework' };
+                    for (const sub of submissions) {
+                        if (!sub.ivanti_current_state) continue;
+                        const mappedStatus = STATE_MAP[sub.ivanti_current_state.toUpperCase()];
+                        if (mappedStatus && mappedStatus !== sub.lifecycle_status) {
+                            try {
+                                await pool.query(
+                                    `UPDATE ivanti_fp_submissions SET lifecycle_status = $1, updated_at = NOW() WHERE id = $2`,
+                                    [mappedStatus, sub.id]
+                                );
+                                sub.lifecycle_status = mappedStatus;
+                            } catch (syncErr) { console.error(`Failed to sync lifecycle_status for submission ${sub.id}:`, syncErr.message); }
+                        }
+                    }
                 }
             }
             res.json(submissions);