fix(api): guard unmoved deals before pipeline merge delete

Co-authored-by: Cursor <cursoragent@cursor.com>

.superpowers/sdd/task-5-report.md

@@ -0,0 +1,17 @@
+# Task 5 report
+Status: DONE
+- shared build: OK
+- pipeline-merge.test.ts: 5/5 pass
+- api typecheck: OK
+- vue-tsc: see VUE_EXIT in controller log
+- graphify: attempted (may crash)
+No commit required for verification-only task.
+
+## Follow-up fix: final review important findings
+Status: DONE
+- I-1: Added in-transaction unmoved-deal count guard before deleting the source pipeline.
+- I-3: Added 30000ms timeout to the interactive merge transaction.
+- M-1: Added `@IsIn(['retarget_all'])` validation to `MergePipelineDto.leadFormMode`.
+- graphify update: OK
+- `cd apps/api; npx tsx --test test/pipeline-merge.test.ts`: OK, 5/5 pass
+- `npm run typecheck -w @mento/api`: OK