feat(pii): self-service per-column masking policy enforced for the LLM

- pii_catalog: persistent per-column masking policy (default masked); GET/POST
  /api/pii/policy and POST /api/pii/lookup which redacts masked values server-side.
- get_pii masked flag now reflects the policy; dataflow exposes the dataset key.
- Data Flow PII inspector: per-column lock/unlock toggles + mask-all/unmask-all,
  so operators control exactly which data the assistant may reveal.

ui/src/lib/api.ts

@@ -155,6 +155,14 @@ export async function fetchPii(refresh = false): Promise<{ datasets: PiiDataset[
   )
 }
 
+export function setPiiMask(key: string, column: string, masked: boolean) {
+  return fetch('/api/pii/policy', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ key, column, masked }),
+  })
+}
+
 export function toggleEtlAgent(enabled?: boolean) {
   return fetch('/api/agent-ops/etl/toggle', {
     method: 'POST',