feat(llm): add Mistral support and finalize audit closure

[brownjuly2003-code]

Summary

Integrates the verified post-v0.5.0 follow-up range: a local BYOK runbook,
direct Mistral provider support with budget/usage accounting, current DataLens
live-response contract compatibility, and final audit/external-evidence
reconciliation. The final polish commit also reports the configured hosted LLM
provider accurately in readiness output and covers the
AUTO_BI_MISTRAL_API_KEY alias.

Audit accounting remains exact: 21 historical rows closed, 3 excluded from
current scope, and active work remaining 0.

Type of change

• Bug fix
• Feature / enhancement
• Security hardening
• Docs only
• CI / release / infra
• Dependency bump (Dependabot or manual)

Security checklist

• No secrets, tokens, passwords, recovery codes, or live DSN in code, tests, fixtures, logs, or docs
• No new path that sends DWH values to an external LLM unless AUTO_BI_SEND_SAMPLES opt-in + classification allow it
• User-facing errors stay SafeError-shaped (no provider body, URI credentials, cookies, or raw stack traces)
• New/changed HTTP surface respects auth/RBAC and demo capability gates where relevant (no new HTTP surface)
• Dependency / image pin changes include a reason and, if available, a CVE id (no dependency/image pin change)

Data / privacy

• Samples / top-values / free-text paths still go through prompt_data sanitization
• Classification defaults not weakened (confidential/restricted never send samples)
• No new logging of sample values or connection secrets

Docs

• USER_GUIDE / DEPLOYMENT / ARCHITECTURE / SECURITY / CHANGELOG updated when public behaviour or defaults change
• docs/CURRENT_STATE.md updated when product status or residual roadmap changes
• .env.example matches new Settings fields and defaults
• After Settings field/default change: regenerated docs/ENV_REFERENCE.md; --check reports 70/70 keys
• Migration note added if a default flips or a public response shape breaks (no default/public breaking change)
• Documented defaults still match Settings
• No new claim wider than CI release gates
• Version string remains consistent at v0.5.0

Release / deploy

• No release, deploy, mutable-tag promotion, or dependency/image-pin change is performed by this PR

Test plan

Local pre-push evidence on Windows / Python 3.12:

Ruff: passed
Black: 182 files unchanged
mypy --strict auto_bi: 82 source files, no issues
pre-commit (changed files): all applicable hooks passed
ENV reference generator: 70 keys, current
pytest + coverage: 1376 passed, 4 skipped, 38 deselected; 94.98%
Advisor: ClickHouse 9/9; Greenplum 6/6
Golden replay: ClickHouse 37/37; Greenplum 16/16
wheel + sdist: built; twine check passed
git diff --check: passed

The local pip-audit process did not finish within 300 seconds and the host has
no local gitleaks binary. The protected main ruleset therefore remains the
source of truth for those required GitHub checks; this PR must not merge unless
all required checks are green.

• Local quality, type, test, replay, and package gates above are green
• New/changed behaviour covered by unit or contract tests
• Prompt / advisor changes covered by the offline advisor and golden replay
• Required GitHub integration, CodeQL, gitleaks, dependency-audit, and image-drift checks will gate merge

Risk / rollback

Mistral is opt-in through provider configuration; existing provider defaults and
data-classification controls are unchanged. The live sentinel can select
Mistral when a Mistral secret exists and no explicit provider override is set.
Rollback is a normal PR revert; no migration or remote data mutation is needed.