feat: Authentik login + switchable GPU prod target

Add OIDC auth for Command Center and runtime GPU endpoint selection
pointed at atc-gpu-prod (10.0.10.106), matching what is currently deployed.

api/platform_context.py

@@ -90,15 +90,15 @@ def build_platform_section() -> str:
     return "\n".join(lines)
 
 
-def build_masking_section() -> str:
+def build_masking_section(fresh: bool = False) -> str:
     """Exact masking policy + strict guidance so the LLM can answer about masked
-    data without ever revealing masked raw values."""
-    lines: list[str] = ["=== DATA MASKING POLICY (enforced) ==="]
+    data without ever revealing masked raw values. Synced with Data Flow toggles."""
+    lines: list[str] = ["=== DATA MASKING POLICY (enforced — synced with Data Flow) ==="]
     masked: list[str] = []
     unmasked: list[str] = []
     try:
         from pii_catalog import get_pii  # type: ignore
-        data = get_pii()
+        data = get_pii(use_cache=not fresh)
         for d in data.get("datasets", []):
             for c in d.get("pii_columns", []):
                 tag = f"{d.get('label')}.{c.get('name')} [{c.get('category')}]"
@@ -112,22 +112,27 @@ def build_masking_section() -> str:
         lines.append(f"(masking catalog unavailable: {exc})")
 
     if masked:
-        lines.append("MASKED columns (raw values are withheld — token 🔒 MASKED):")
+        lines.append("MASKED columns (raw values withheld — token 🔒 MASKED):")
         for m in masked[:40]:
             lines.append(f"  - {m}")
+    else:
+        lines.append("MASKED columns: (none)")
     if unmasked:
-        lines.append("Visible PII columns (operator opted out of masking):")
+        lines.append("VISIBLE columns (operator opted out of masking in Data Flow — real values OK):")
         for u in unmasked[:40]:
             lines.append(f"  - {u}")
+    else:
+        lines.append("VISIBLE columns: (none — all PII masked)")
 
     lines += [
         "",
-        "How to handle masked data when answering:",
-        "  1. NEVER reveal, guess, reconstruct or print the raw value of a MASKED column. If a value comes in as '🔒 MASKED', keep it masked.",
-        "  2. DO still answer helpfully: confirm the column exists and is masked for privacy/governance, and explain why (PII protection policy).",
-        "  3. You MAY use and report non-sensitive aggregates, counts, distributions and derived metrics over masked columns (e.g. 'there are N distinct customers') as long as no individual raw value is exposed.",
-        "  4. Tell the operator they can unmask a specific column from the Data Flow PII overlay if they have the authority, and that the curated/masked Iceberg layer is physically masked and cannot be unmasked.",
-        "  5. Unmasked PII columns may be shown, but flag that they are sensitive.",
+        "How to handle masked vs visible data when answering:",
+        "  1. MASKED: NEVER reveal, guess, or reconstruct raw values. Quote '🔒 MASKED' when present.",
+        "  2. VISIBLE: you MAY show the real sample values and state that the operator made them visible in Data Flow.",
+        "  3. DO still answer helpfully: confirm which columns are masked vs visible from the lists above.",
+        "  4. You MAY use non-sensitive aggregates/counts over masked columns without exposing individuals.",
+        "  5. Curated/masked Iceberg layers are physically masked and cannot be unmasked from the UI.",
+        "  6. Never invent PII that is not in the live samples.",
     ]
     return "\n".join(lines)