feat(backend): thin FastAPI wrapper around the ingen CLI

[maan-iitd2]

What

Adds backend/app/ — a thin, local-dev-only FastAPI service that runs the InGen CLI and returns structured results. It contains no business logic: it shells out to python -m ingen, parses the CLI's output, and hands JSON back to a frontend (the InGen Studio SPA, not part of this PR).

Module	Responsibility
main.py	HTTP routing only — parses requests, delegates, returns JSON
runner.py	Writes posted YAML to a temp file, runs the CLI as a subprocess, parses real log output into a structured RunRecord (per-stage status, timing, log level)
store.py	Persists RunRecords to INGEN_RUNS_DIR for history/lookup
schema_validate.py / validation.py	Validate a config (and surface a run's validation results) without executing it
files.py	Sample-data upload with size/type caps, reads only file headers for column preview (not the whole file)
columns.py	Derives the column list a configured data source would produce

Deliberately excluded from this PR: the inChat assistant (backend/app/chat.py), which pulls in torch/transformers/HuggingFace and is a separable concern with its own dependency weight — follow-up PR. main.py in this PR has no chat import, no /api/chat* routes.

Trust boundary

This wrapper executes whatever config is posted (file reads, SQL, API calls — that's InGen's nature). It's intended for local/trusted development only — no auth, sandboxing, or network egress controls, by design.

Testing

• pytest backend/tests/ — 42 passed.
• Verified backend.app.main imports cleanly and registers all 9 routes with torch/transformers/accelerate/safetensors/tokenizers/huggingface_hub deliberately blocked at import time (via sys.meta_path), proving this PR carries no import-time dependency on the inChat stack even though those packages happened to be present in the test environment.
• End-to-end: booted uvicorn backend.app.main:app --port 8123, then:
  • GET /api/health → {"status": "ok"}
  • POST /api/configs/validate with a real config → validated correctly
  • POST /api/runs with a real XML-source config → the CLI subprocess ran the full read → pre_process → format → validate → write pipeline and the endpoint returned a RunRecord with "status": "success" and per-stage logs.
• backend/README.md had drifted from main.py (missing the files/columns endpoints, wrong default CORS ports/origin). Corrected it to describe exactly what this PR ships.

🤖 Generated with Claude Code