fix: review findings batch - wiki auth, pg_adapter allowlist, 003 migration, ingest txn, true SSE, docker/CI/docs

[sanjeevafk]

Batch fix for the project review findings (all items per agreed scope: wiki auth-only, API keys preserve+extend, true SSE, defer 70% coverage + rank-bm25 swap).

Security

• Wiki lint/concepts routes now require auth (shared vault kept)
• pg_adapter allowlists RPC functions/tables/columns
• Removed pickle FilesystemRAGStore (RCE path, dead code)
• API keys: constant-time compare + optional expires_at/scopes/revoked_at via 003 (old hashes still work)

Correctness

• Fixed reinitialize_cache NameError; pyright single-sourced to pyrightconfig.json
• New db/migrations/003_fixes.sql: UUID defaults, centered get_neighbor_chunks, cascading delete_collection, key columns (verified live against pgvector:pg17)
• Ingest: chunk/embed/graph moved out of txn with pre-txn idempotency short-circuit; 403 on cross-tenant collection; ILIKE metachars escaped; bare excepts now log

Streaming

• True token SSE via OpenAI stream + shared _retrieve helper (single LLM call), disconnect-aware

Ops/docs

• Dockerfile: non-root USER, HEALTHCHECK, strips tests; Dockerfile.test fixed (async deps, both suites); .dockerignore covers .env*
• New .github/workflows/ci.yml (ruff+pytest); README fixed (no demo/, key length aligned, docker contexts)
• Eval: --seed, shrink warning, retired-baseline no longer raises; stale modular_services README corrected

Verification: 190/190 pytest pass, ruff + compileall + diff-check clean, 003 applied live (queue/neighbor/delete_collection exercised).

Excluded: pre-existing dirty scripts/benchmark_beir.py (unrelated BEIR multi-dataset WIP) left uncommitted.