feat: add admin/internal database API with CRUD, read-only query, and natural-language SQL endpoints

Add a new `/dbapi` router package providing a generic database API over `dataset`, restricted to admin sessions, admin API keys, and the internal gateway key. Includes:

- `tables.py`: list all tables and inspect table schemas
- `crud.py`: full CRUD operations (GET, POST, PATCH, DELETE) with soft-delete awareness, born-live inserts, `?include_deleted`, `.../restore`, and `?hard=true` purge
- `query.py`: validated read-only SELECT execution via sqlglot parsing, classification, and EXPLAIN dry-run; async query jobs with WebSocket streaming via `DbApiJobService`
- `nl.py`: natural-language-to-SQL conversion using the platform AI gateway with re-prompting until validation passes

Also register `DbApiJobService` and `PubSubService` in the service manager, add `DBAPI_DIR` to config data paths, and force cleartext `http://` connections to HTTP/1.1 in `curl_transport` to fix large request failures against uvicorn's HTTP/1.1-only internal gateway.

tests/unit/curl_transport.py

@@ -2,10 +2,11 @@
 
 import httpx
 import pytest
+from curl_cffi import CurlHttpVersion
 from curl_cffi.requests.exceptions import RequestException, Timeout
 
 import devplacepy.curl_transport as ct
-from devplacepy.curl_transport import CurlTransport, resolve_timeout
+from devplacepy.curl_transport import CurlTransport, http_version_for, resolve_timeout
 from tests.conftest import run_async
 
 
@@ -134,3 +135,31 @@ def test_aclose_closes_session(monkeypatch):
     transport, fake = make_transport(monkeypatch)
     run_async(transport.aclose())
     assert fake.closed is True
+
+
+def test_http_version_for_selects_http1_on_cleartext():
+    assert http_version_for(httpx.URL("http://localhost:10500/x")) == CurlHttpVersion.V1_1
+    assert http_version_for(httpx.URL("https://example.com/")) is None
+
+
+def test_cleartext_request_forces_http1_1(monkeypatch):
+    # A plaintext http:// origin (the internal localhost gateway hop) must be sent
+    # as HTTP/1.1: curl impersonation otherwise attempts cleartext HTTP/2, which a
+    # uvicorn (HTTP/1.1-only) server rejects as "Invalid HTTP request received."
+    # once the request body is large (~128KB, e.g. the Devii tool list).
+    transport, fake = make_transport(monkeypatch)
+    run_async(
+        transport.handle_async_request(
+            httpx.Request("POST", "http://localhost:10500/openai/v1/x", content=b"{}")
+        )
+    )
+    assert fake.calls[0]["http_version"] == CurlHttpVersion.V1_1
+
+
+def test_tls_request_keeps_impersonation_default(monkeypatch):
+    # https keeps the Chrome HTTP/2-over-TLS fingerprint: no version override.
+    transport, fake = make_transport(monkeypatch)
+    run_async(
+        transport.handle_async_request(httpx.Request("GET", "https://api.example.com/v1/x"))
+    )
+    assert "http_version" not in fake.calls[0]