feat(knowledge-graph): structured dataset ingestion via CSV import

[Weegy]

Summary

Adds structured dataset ingestion to the Knowledge Graph: CSV files (uploaded via a new REST surface, or attached in chat) are parsed, privacy-scanned, and persisted as queryable datasets instead of being treated as opaque text blobs.

• New KnowledgeGraph surface — ingestDataset, listDatasets, getDataset, queryDatasetRows, deleteDataset — backed by a relational sidecar (datasets + dataset_rows tables, migration 0029_datasets.sql). Individual rows never become graph nodes; exactly one Dataset node (PluginEntity, system='dataset') is created per dataset for recall/citation linking. Implemented with full parity in both @omadia/knowledge-graph-neon (parameterized SQL/JSONB) and @omadia/knowledge-graph-inmemory.
• POST /api/v1/datasets (multipart CSV upload), GET /api/v1/datasets, GET /api/v1/datasets/:id, GET /api/v1/datasets/:id/rows, DELETE /api/v1/datasets/:id — ACL pattern mirrors /api/v1/memory (session-derived owner only, no anonymous access).
• CSV chat attachments now import as a queryable dataset instead of being silently truncated at the existing 20,000-char text cap.
• New query_dataset native tool: list_datasets / get_schema / query_rows, a constrained filter+aggregate DSL (never raw SQL from the model), always paginated/aggregated server-side.
• Every imported row runs through the existing C0 regex PII-detector baseline (@omadia/plugin-privacy-guard) before persistence. On a detected hit, the entire import is rejected (naming only the offending column/row indexes, never the flagged value) — the scan never silently masks or fabricates a substitute value. See fixup history below for why.
• Admin UI (upload/schema/delete page) is intentionally out of scope for this change — tracked as a follow-up in Knowledge Graph datasets: admin UI (upload/schema/delete page) #532.

Fixup history (adversarial review, 7 rounds)

1. inferColumnType no longer types a column as number when any value has a leading zero (e.g. '0301234567') — such values are zero-padded identifiers, not numbers; typing them as number both corrupted the value (Number() drops the leading zero) and skipped the mandatory privacy scan.
2. Chat-attachment CSV auto-ingest now resolves the canonical omadiaUserId (via resolveOrCreateChannelIdentity) instead of writing the raw channel-native id as ownerOmadiaUserId; per-cell truncation (MAX_CELL_CHARS) is no longer silent (truncation stats surfaced); NeonKnowledgeGraph's contains filter escapes SQL ILIKE wildcards; InMemoryKnowledgeGraph's grouped dataset query caps at 200 groups, matching Neon's LIMIT 200.
3. InMemoryKnowledgeGraph's dataset filter comparisons (eq/neq/contains) now coerce values by the column's declared type, mirroring NeonKnowledgeGraph's SQL cast behavior — previously a query could silently return totalMatched: 0 on the in-memory backend for a logically-identical Neon query.
4. Privacy-scan redesign (maintainer decision after direct execution disproved the original design): the scan originally ran every string/date cell through maskPrompt() — built for masking spans inside free-text chat prompts — and persisted only the masked/substituted text. Verified this silently, permanently corrupted legitimate structured values ('€72,000' → '€10000', '24.12.1987' → '01.01.1970', a real address → a fabricated one), since the free-text baseline has a high false-positive rate on formatted structured data. Redesigned to detect-only, reject-on-hit: nothing is ever auto-substituted; a detected identifying span (email/IBAN/phone/address/date-in-free-text) rejects the whole import with a column+row-index error instead.
5. Channel-identity resolution is now done once per turn (resolveTurnOwnerIdentity) and shared between the CSV-import path and QueryDatasetTool — previously a dataset imported via a channel turn (Teams/Slack/Telegram) could never be found again by query_dataset from that same channel, because the query path read the raw channel-native id while the dataset was stored under the resolved canonical id.
6. The leading-zero guard from fixup 1 only matched an unsigned leading zero (/^0\d/); a signed zero-padded value (-0123) still slipped through as number. Widened to /^-?0\d/.
7. POST /api/v1/datasets was the only one of the five dataset route handlers with no try/catch around its core call — an unexpected thrown error (e.g. a transient Postgres failure) fell through to Express's default HTML error page instead of the {code, message} JSON envelope every other dataset endpoint returns. Fixed to match the other four handlers.

Test plan

• npm --prefix middleware run typecheck — 0 errors across all workspaces.
• npm --prefix middleware run lint — 0 errors.
• npm --prefix middleware test — full suite green modulo pre-existing, unrelated full-suite-only test-pollution flakes (each confirmed passing in isolation across every round).
• New/updated test coverage: datasetImport.test.ts, datasetsRoute.test.ts, inMemoryKnowledgeGraph.test.ts, neonDatasetFilterEscaping.test.ts, orchestratorCsvDatasetIdentity.test.ts, orchestratorDispatcher.test.ts, queryDatasetTool.test.ts.

31 files changed, +3444/-8 across 7 commits.

Addresses #430 (CSV import/query path). The admin upload/schema/delete UI required by #430's own acceptance criteria is intentionally deferred — tracked as #532.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}