feat: experiment metrics, model downloads, viz controls, and auth improvements

[Jovonni]

Summary

• Experiment runs: Added model_id column to experiment_runs table so notebook-trained models (no K8s job)
  can link to experiments. Updated API, SDK, and frontend.
• Model metrics tab: Models now display experiment run metrics (accuracy, F1, hyperparameters) instead of
  showing blank when trained from notebooks.
• Model download: Added "Download Model" button on model detail page — serves checkpoint artifacts or embedded
  base64 model blobs via /sdk/models/{id}/artifact.
• Visualization downloads: Added download button on visualization detail page and dashboard panels. Supports
  SVG, PNG, Plotly, Vega-Lite, and Bokeh exports.
• Code toggle: Visualization detail page now has a "Hide Code / Show Code" button matching the existing preview
  toggle.
• Auth improvements: Extended JWT access token from 15 min to 24 hours; added automatic refresh token flow in
  frontend to prevent frequent logouts.
• Bug fixes: Dataset schema display, API key copy, experiment detail auto-refresh polling, workspace pod RBAC,
  nullable job_id on experiment runs.

Test plan

• Open a model page → verify Metrics tab shows experiment run metrics (accuracy bars, hyperparameters)
• Click "Download Model" on a model page → verify file downloads (.pt or .pkl)
• Open a visualization → verify Download button exports image, Hide/Show Code toggles editor
• Open a dashboard → verify download icon on each panel header works
• Verify login session persists without frequent logouts
• Run notebook experiments → verify experiment runs link to models correctly