feat(pii): self-service per-column masking policy enforced for the LLM

- pii_catalog: persistent per-column masking policy (default masked); GET/POST
  /api/pii/policy and POST /api/pii/lookup which redacts masked values server-side.
- get_pii masked flag now reflects the policy; dataflow exposes the dataset key.
- Data Flow PII inspector: per-column lock/unlock toggles + mask-all/unmask-all,
  so operators control exactly which data the assistant may reveal.

ui/src/types.ts

@@ -70,7 +70,7 @@ export type CdcStats = {
   consumed: number
 }
 
-export type PiiColumn = { name: string; category: string; masked: boolean }
+export type PiiColumn = { name: string; category: string; masked: boolean; policy_locked?: boolean }
 
 export type DataflowNode = {
   id: string
@@ -83,6 +83,7 @@ export type DataflowNode = {
   metric: string | null
   url?: string
   pii?: {
+    key: string
     has_pii: boolean
     pii_count: number
     all_masked: boolean