Phase 7: AI-assisted query authoring (autocomplete, explain, fix, optimize, NL translation)

Adds a self-hosted (Ollama, qwen2.5-coder) model provider abstraction
with a pluggable opt-in cloud adapter, schema grounding, and a shared
cost/safety guard every AI-suggested query is assessed against --
compiling to and executing through the same unchanged Phase 2 IR/
compiler and Phase 4 tenant scoping as a hand-written query, no
parallel execution path.

Track A (built into the query bar): inline ghost-text autocomplete,
"Explain this query", "Fix this query" with a diff view, and a
rule-based "Optimize" suggestion. Track B: natural-language-to-query
translation, always a separate review step from execution, with
`sentryctl query --nl` requiring explicit confirmation to run.
Every accepted/dismissed translate-fix-optimize interaction is logged
into the same append-only audit_log table Phase 4 built.

Two real product bugs were found and fixed via live browser
verification (a Svelte effect re-running on every keystroke that
silently cancelled the ghost-text debounce; a ghost-text widget
positioned at document offset 0 instead of the cursor), and a real
costguard logic bug (unbounded-aggregation vs. raw-row) was caught by
its own test suite. New integration tests wire a real Ollama client
through the real HTTP handler against a mock server matching Ollama's
wire contract (hack/mock-ollama), keeping model-quality verification
out of CI as a disclosed, periodic human-run check instead.

See /docs/phase-7-ai-design.md and /docs/phase-7-runbook.md.

enterprise/internal/audit/audit.go

@@ -47,6 +47,12 @@ const (
 	EventGrantChange     EventType = "grant_change"
 	EventSSOConfigChange EventType = "sso_config_change"
 	EventSecretReveal    EventType = "secret_reveal"
+	// EventAIInteraction (Phase 7 task 12): a translate/fix/optimize
+	// suggestion's accept-or-dismiss outcome. QueryText carries the
+	// resulting query (if any); Detail carries the operation, the
+	// original input, confidence, and whether the user edited the
+	// suggestion before using it -- see ai_interaction_adapter.go.
+	EventAIInteraction EventType = "ai_interaction"
 )
 
 type Status string