refactor: simplify rewrite config and rename risk tolerance levels

[lipikaramaswamy]

Summary

Simplify the user-facing rewrite config and rename risk tolerance levels for clarity.

Config simplification

risk_tolerance and max_repair_iterations are now top-level fields on Rewrite instead of nested inside EvaluationCriteria:

# Before
config = AnonymizerConfig(rewrite=Rewrite(
    evaluation=EvaluationCriteria(risk_tolerance=RiskTolerance.strict, max_repair_iterations=3)
))

# After
config = AnonymizerConfig(rewrite=Rewrite(risk_tolerance="minimal", max_repair_iterations=3))

Risk tolerance rename

Enum values renamed to read naturally as tolerance levels:

Old	New	Threshold
strict	minimal	0.6
conservative	low (default)	1.0
moderate	moderate	1.5
permissive	high	2.0

What changed per file

src/anonymizer/config/rewrite.py

• Rename enum values (strict→minimal, conservative→low, permissive→high)
• Replace flat RISK_TOLERANCE_THRESHOLDS dict and DOMAIN_RISK_TOLERANCE dict with _RiskToleranceBundle dataclass bundling all thresholds per preset
• Add _RISK_TOLERANCE_BUNDLES mapping
• EvaluationCriteria: remove auto_repair_privacy, auto_adjust_by_domain, max_leakage_mass, flag_leakage_mass_above, get_effective_threshold(). Add derived properties (repair_threshold, repair_any_high_leak, flag_utility_below, flag_leakage_above) from bundle
• Default changes from conservative to low (same numeric thresholds)

src/anonymizer/config/anonymizer_config.py

• Rewrite: replace evaluation: EvaluationCriteria field with top-level risk_tolerance and max_repair_iterations fields
• Add Rewrite.evaluation property that constructs EvaluationCriteria internally
• Re-export RiskTolerance

src/anonymizer/__init__.py

• Export RiskTolerance from top-level package

src/anonymizer/engine/rewrite/evaluate.py

• Remove auto_repair_privacy from RepairNeedsParams and determine_repair_needs()
• Remove domain param from EvaluateWorkflow.columns()
• Use evaluation.repair_threshold directly instead of get_effective_threshold(domain)

src/anonymizer/engine/rewrite/final_judge.py

• Rename flag_leakage_mass_above → flag_leakage_above in HumanReviewParams and usage

src/anonymizer/engine/rewrite/rewrite_workflow.py

• Remove _extract_domain() helper and domain plumbing through the evaluate-repair loop
• Use evaluation.repair_threshold directly

Tests: updated to match new enum values and removed params

Test plan

• 78 unit tests pass (config, evaluate, final judge, rewrite workflow)