feat(directory): add Lakebase + File providers

[larsgeorge-db]

Two additional concrete providers + provider-abstraction cleanup. Stacked on #413 — base is `feat/directory-phase3` so the diff here is providers-only. Will rebase onto `main` once the rest of the stack lands.

Plan: #375 · Backend (Phase 1): #406 · Phase 1 frontend: #407 · Phase 2: #412 · Phase 3: #413

Summary

• `LakebaseProvider` — reads principals from a Postgres / Lakebase table via the app's existing SQLAlchemy engine. Identifier validation rejects SQL-injection attempts at the table-name level; queries use parameterised `LIKE`/`ESCAPE` for portable case-insensitive prefix search; user wildcards (`%`/`_`) are escaped so a raw `%` can't dump the directory.
• `FileProvider` — CSV-backed, primarily for tests and offline dev. Required columns: `type`, `id`, `display_name` (`sub_label` optional). Re-reads on `mtime` change via a class-level cache, no restart needed.
• Provider abstraction generalisation: factories now take `(DirectoryProviderContext, DirectoryProviderConfig)` instead of `(ws_client, connection_name)`. The context carries transport handles (ws_client, db_engine); the config is one bag containing every directory setting and each provider reads only the fields relevant to its type. Adding a future provider is one entry in `_PROVIDER_REGISTRY` + an optional `_REQUIRED_KEYS` row.
• Settings keys: `DIRECTORY_LAKEBASE_TABLE`, `DIRECTORY_FILE_PATH` added alongside the existing `DIRECTORY_UC_HTTP_CONNECTION_NAME`. All three live in `app_settings` — still no Alembic migration.
• `DirectoryStatus` carries all three config fields so the Settings tab hydrates inputs in one round trip.
• Each provider's required-key set is declared centrally; `configured` is False whenever any required key for the active provider is missing.

Settings tab UI

Provider Select enables all three options; the panel below switches between `EntraPanel` / `LakebasePanel` / `FilePanel` on selection. Each renders:

• Entra: UC HTTP Connection dropdown + token/scope/grant-type help block (unchanged from feat(directory): Phase 1 frontend — Settings tab + PrincipalPicker #407).
• Lakebase: FQN `Input` + required-schema SQL snippet in the help block.
• File: absolute path `Input` + CSV format example.

Form state is preserved per-field when toggling providers so users don't lose typed values.

Test plan

• Backend directory tests: 67 passed (16 Entra + 17 manager + 18 Lakebase + 16 File).
• Targeted directory + workflow regression: 158 passed.
• Frontend type-check clean (`yarn type-check`).
• Frontend lint clean on touched files.
• Frontend suite unaffected: 705 passed, 6 skipped.
• New backend tests:
  • `test_lakebase_provider.py` (18): FQN validation rejects illegal identifiers / SQL-injection probes; prefix search hits `display_name` and `id`; result shape; type filter; `top` cap; `%`/`_` wildcard escape; `get_user` happy/missing/empty paths; `test()` probe succeeds and fails on missing table; ctx/config validation.
  • `test_file_provider.py` (15): CSV parsing happy path, blank rows skipped, blank id rejected, unknown type rejected, missing required columns rejected; case-insensitive prefix; id-column match; `top` cap; mtime-based cache re-read; `test()` probe.
  • `test_directory_manager.py` (+3 new): `DirectoryStatus` exposes all per-provider fields; `configured=False` when required setting absent; `manager.test` raises a clear "missing required" message when a recognised provider lacks its required setting.
  • `test_entra_id_provider.py` (16): unchanged behaviour, migrated to the new `(ctx, config)` factory signature.
• Manual smoke test of all three providers in a workspace (left for reviewer / follow-up).

Notes for reviewers

• The change to the provider factory signature is intentionally invasive — the old `(ws_client, connection_name)` couldn't cleanly carry per-provider config. The new shape is the load-bearing piece of "the abstraction was correct".
• `LakebaseProvider` uses the app's own SQLAlchemy engine via `db.get_bind()`. The principal table is expected to live on the same Postgres / Lakebase database the app already talks to. If a customer wants the principal directory on a separate database, that's a future extension (new ctx field).
• `FileProvider` is intentionally tiny: no remote fetch, no schema beyond four columns. The intended use is tests, demos, and air-gapped dev environments.