feat(041): cross-source alignment with SchemaView dedup

[satra]

Summary

• All 8 adapters now produce LinkML SchemaDefinitions — ReproSchema, NDA, OpenNeuro, and BIDS converted to to_linkml(). SchemaView deduplicates shared slots across classes (e.g., participant_id used by 100 OpenNeuro datasets → 1 element).
• Multi-signal alignment pipeline — 4-signal weighted scoring (name 0.3, embedding 0.3, ontology 0.25, alias 0.15) with name blocking + embedding k-NN candidate generation, union-find group formation, range compatibility check.
• Graph-based alignment persistence — aligned_to/aligned_members sha256 fields on all entity types. Canonical designation: earliest created_at for identical entities, no unnecessary new entities.
• Search-driven feedback loop — semantic search results flag unaligned high-similarity entities as alignment candidates for the next pipeline run.
• Full stack: backend DB models + GraphQL types + resolvers + frontend queries + element detail page alignment UI.

Results (7 sources)

• 35,657 entities → 708 alignment groups, 13,073 merged (37% reduction)
• 44 conflicts correctly flagged (different ranges, not merged)
• Alignment runtime: 2:27 for 11K entities, 48 min for 35K

Test plan

• Library tests pass (uv run pytest tests/ -v)
• Frontend builds (pnpm build)
• Backend lint passes (uv run ruff check src/)
• Run pipeline for any source → verify SchemaView extraction produces deduplicated entities
• Run uv run undata-library align → verify alignment groups form correctly
• Check element detail page shows alignment info when aligned_to/aligned_members present

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request implements "Iteration 2" of the undata project, introducing a new architecture centered around a standalone flat-file library and a FastAPI/GraphQL backend. Major updates include a complete rewrite of the project's constitution and development guidelines, the addition of a comprehensive seeding system, and the implementation of OIDC authentication. Feedback identified security vulnerabilities, specifically the logging of sensitive authorization headers and a potential authentication bypass in the chat endpoint. It was also recommended to replace the hardcoded secret key in the example configuration with a placeholder to improve the project's security posture.

[gemini-code-assist]

The auth_me endpoint logs sensitive authorization headers. This could lead to credential leakage in logs. Ensure that sensitive parts of the header are masked or removed before logging.

[gemini-code-assist]

The chat endpoint allows unauthenticated access if KEYCLOAK_URL is not set. This bypasses security controls in development environments. Consider enforcing authentication consistently or using a more secure development mock.

[gemini-code-assist]

The secret key is hardcoded in the example file. While this is an example, it is safer to use a placeholder that clearly indicates it must be replaced, or generate a random one, to prevent accidental use of a known 'dev-secret' in production environments.