ADR-009 stages 9.3-9.6: secret scrubbing, .graphlink archive, asset store, flat edge format

[dovvnloading]

Completes ADR-009. Stages 9.1-9.2 (migrations, backups, corrupt-DB
recovery) landed in #303; this is the remaining four.

Problem

Nothing decided in one place what counts as a secret, so anything leaving
the app had to be trusted not to carry credentials or local paths. There
was no way to get data out at all. Chat rows carried image bytes inline as
base64, so every 30-second autosave rewrote megabytes for pictures that had
not changed. The on-disk edge format was a 14-bucket classification
inherited from a deleted Qt app, encoding distinctions this backend cannot
make — one connect() primitive, not fourteen visual edge types.

Change

9.3 — secret scrubbing. One chokepoint, backend/secret_scrub.py,
matching both on key name and on credential-shaped values, plus absolute
paths in all three forms (Windows, UNC, POSIX). Value-based matching is the
point: a credential pasted into a note under an unremarkable field name is
the realistic leak, not a tidily-named api_key.

9.4 — the .graphlink archive. A plain zip: chats as JSON, assets as
real files, so it is readable without this app. Every payload is scrubbed
on the way out. Import validates before writing anything, refuses zip-slip
and absolute member names, caps member size against decompression bombs,
refuses newer format versions rather than guessing, and drops assets whose
bytes do not hash to their own ref.

9.5 — asset externalization. build_chat_data takes an optional asset
store; with one present an image node serializes to a content-addressed ref
instead of inline base64, and session_load reads either shape. Wired into
all four production paths (autosave, save, the load-time digest baseline,
eviction flush) through one store_for(db_path) helper — all four, because
a mismatch between them would make the first tick after a load rewrite a
row that is already correct. A ref the store cannot resolve costs the
picture, never the conversation.

The store reaches the serializer through a contextvar rather than threading
a parameter through ~20 same-signature dispatch lambdas; the save path is
synchronous throughout, and the wrapper resets in a finally so a failed
save cannot leak a stale store into the next one.

9.6 — flat edge format. A flat edges list becomes the authoritative
edge record and session_load prefers it, retiring the bucket
reconstruction on the read path. Endpoints resolve against a map spanning
nodes, notes and charts, since an edge may legitimately end on any of them.

Both format changes are write-new/read-both: nothing already on disk is
rewritten, and files this build writes still open in older builds — the
legacy edge buckets are still emitted, only reading them is retired.

Test plan

• backend/tests/test_secret_scrub.py (12) — written as attempts to sneak
  a secret past the scrubber rather than a happy-path walk: an unexpected
  field name, a credential in prose, a path inside an error message, a
  secret three containers deep, plus a backstop planting every fixture at
  once. Fixtures are assembled from concatenated parts so no
  credential-shaped literal exists in the source.
• backend/tests/test_workspace_archive.py (16) — round-trip into a
  different asset store (the second-machine case, which a same-store test
  would pass while failing on the machine that matters), zero secrets in
  both the raw zip bytes and the parsed form, and the hostile-input set.
• backend/tests/test_session_format_adr009.py (14) — asset round-trip and
  dedupe across repeated saves, inline fallback for pre-9.5 rows,
  missing-ref degradation, contextvar reset after a failed save; flat-edge
  round-trip including note and chart endpoints, fallback when edges is
  absent, unresolvable and duplicate entries.
• Full suite from repo root: 2156 passed, 16 skipped.