Duplicate leads

Pairs the matcher flagged for review. Merging is never automatic below high confidence, and always keeps both records — the loser is marked as merged, never deleted.