refactor: harden DataAgent backend and reuse Spring AI

[zxuexingzhijie]

What changed

• Add per-agent API-key authentication to the WebFlux streaming endpoints through Spring Security's reactive authentication chain. Keys are returned once, stored as BCrypt hashes with lookup hints, and can be enabled, reset, or revoked.
• Reuse Spring AI and Spring AI Alibaba capabilities for structured model output, graph orchestration, vector retrieval, and model construction; remove obsolete blocking LLM, hybrid-retrieval, factory, and utility implementations.
• Preserve the canonical user requirement through planning and NL2SQL generation so generated SQL follows the original question.
• Harden model configuration, vector deletion, datasource pooling, and knowledge cleanup against secret exposure, stale caches, immutable filters, credential collisions, and incomplete deletion.
• Reduce sensitive runtime logging and prevent optional chart-generation timeouts from cancelling active model requests.
• Include the fork's existing maintenance commits for CI/pnpm compatibility, legacy frontend removal, knowledge-base configuration, vector-store integration, and datasource-password fixes.

Why

The backend had duplicated framework functionality, plaintext API-key handling, several cache and lifecycle race conditions, and runtime logs that could expose prompts, SQL results, datasource details, or model responses. The NL2SQL-only path could also lose the user's canonical instruction. This change consolidates those paths around existing Spring AI Alibaba and Spring Security capabilities and adds regression coverage for the identified failures.

User and developer impact

• Streaming requests return 401 when an enabled agent key is missing or invalid and continue normally with a valid X-API-Key.
• Model configuration list responses mask provider and proxy credentials without breaking internal model creation or updates.
• Existing Milvus and datasource workflows remain compatible; optional chart output falls back to a table without failing the main report flow.
• No images, model artifacts, local credentials, or runtime output are included.

Validation

• ./mvnw clean verify: 1,629 tests, 0 failures/errors; JaCoCo, Checkstyle, and Spotless passed.
• ./mvnw -DskipTests install: passed with JaCoCo correctly skipped.
• Real end-to-end validation with the configured Qwen chat/embedding models, Docker Milvus, and MySQL: missing/wrong API keys returned 401; valid key returned 200; SSE completed without an error after retrieval, NL2SQL generation, SQL execution, and report generation; the database count result was 4 and was present in the report.
• Temporary validation keys were deleted and the local application process was stopped after verification.

Follow-ups

• Management endpoints still need an explicit gateway or administrator authentication boundary before they can be restricted safely.
• Provider API keys remain plaintext at rest and should be migrated to a KMS-backed encryption design separately.