feat: add admin/internal database API with CRUD, read-only query, and natural-language SQL endpoints

Add a new `/dbapi` router package providing a generic database API over `dataset`, restricted to admin sessions, admin API keys, and the internal gateway key. Includes:

- `tables.py`: list all tables and inspect table schemas
- `crud.py`: full CRUD operations (GET, POST, PATCH, DELETE) with soft-delete awareness, born-live inserts, `?include_deleted`, `.../restore`, and `?hard=true` purge
- `query.py`: validated read-only SELECT execution via sqlglot parsing, classification, and EXPLAIN dry-run; async query jobs with WebSocket streaming via `DbApiJobService`
- `nl.py`: natural-language-to-SQL conversion using the platform AI gateway with re-prompting until validation passes

Also register `DbApiJobService` and `PubSubService` in the service manager, add `DBAPI_DIR` to config data paths, and force cleartext `http://` connections to HTTP/1.1 in `curl_transport` to fix large request failures against uvicorn's HTTP/1.1-only internal gateway.

tests/unit/services/devii/actions/__init__.py

@@ -0,0 +1 @@
+# retoor <retoor@molodetz.nl>

tests/unit/services/devii/actions/catalog.py

@@ -0,0 +1,37 @@
+# retoor <retoor@molodetz.nl>
+
+from devplacepy.services.devii.actions.catalog import PLATFORM_CATALOG
+from devplacepy.services.devii.actions.dispatcher import (
+    CONFIRM_REQUIRED,
+    MUTATING_METHODS,
+)
+
+BY_NAME = PLATFORM_CATALOG.by_name()
+
+
+def _records_mutation(name: str) -> bool:
+    action = BY_NAME[name]
+    return action.method in MUTATING_METHODS and not action.is_read_only
+
+
+def test_read_only_query_tools_are_marked_read_only():
+    # These are POST routes (they carry a body) but only read data. They MUST be
+    # read-only so they do not trip the agentic plan gate or the verification gate
+    # and drop the rows the user asked for.
+    for name in ("db_query", "db_design_query"):
+        assert BY_NAME[name].is_read_only is True
+        assert _records_mutation(name) is False
+
+
+def test_db_get_tools_are_read_only():
+    for name in ("db_list_tables", "db_table_schema", "db_list_rows", "db_get_row"):
+        assert BY_NAME[name].is_read_only is True
+        assert _records_mutation(name) is False
+
+
+def test_db_mutation_tools_record_and_confirm():
+    for name in ("db_insert_row", "db_update_row", "db_delete_row"):
+        action = BY_NAME[name]
+        assert action.is_read_only is False
+        assert _records_mutation(name) is True
+        assert name in CONFIRM_REQUIRED