Owners edit published listings via pending edit queue, not direct overwrite

Allowing listing owners to directly overwrite approved content gives any compromised or malicious owner account the ability to replace a legitimate listing with spam, phishing links, or defamatory text that goes live instantly. CWE-285 (Improper Authorization) and OWASP A01 apply — ownership of a listing does not grant the right to bypass editorial review. This is especially acute because a single bad edit can damage the directory's SEO and brand before any moderator notices.

Store owner edits in a listing_edits staging table and apply them only after moderator approval. The public listing record stays unchanged until the edit is approved:

CREATE TABLE listing_edits (
  id SERIAL PRIMARY KEY,
  listing_id INT NOT NULL REFERENCES listings(id),
  owner_id VARCHAR NOT NULL,
  field_name VARCHAR(50) NOT NULL,
  old_value TEXT,
  new_value TEXT NOT NULL,
  status VARCHAR NOT NULL DEFAULT 'pending',
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  reviewed_at TIMESTAMPTZ
);

In app/api/listings/[id]/edit/route.ts, insert rows into listing_edits and return 202 Accepted — never PATCH the listings row directly. In the admin route, apply approved edits by copying new_value back to the parent listing and setting reviewed_at.