fix: harden transports, streaming, reports, and data-asset publish; i…

[lanerchenbuna]

…mprove evaluation metrics

• Transport: optional QUERYFORGE_API_KEY auth + DATABASE_ALLOWLIST / REPORT_ROOT_ALLOWLIST path confinement for network entrypoints
• SSE: terminal final_result event carrying the answer/error, bounded queue, cooperative cancellation on client disconnect
• Reports: escape </script> breakout in chart spec JSON + CSP/nosniff
• Data assets: transactional publish (backup-based checkpoint, BEGIN IMMEDIATE, builder lock, bounded existing-key reads)
• Studio: configurable auth, honest server-side upload validation, run-history integrity (status/id/length validation, is_demo flag, ON CONFLICT DO NOTHING)
• Evaluation: real policy precision/recall over generated SQL, column-order-tolerant semantic equivalence, warmup-free latency, configurable exit-code gates
• Docs: sync README (EN/ZH), evaluation guide, .env.example

Summary

Semantic and Security Impact

Verification

• Focused tests added or updated
• make check passes
• Documentation updated
• No credentials, private data, or generated run state included
• Bundled sample data was preserved

Compatibility