Custom patterns + configurable guardrails

[martsokha]

Summary

Adds caller-inlined regex + dictionary rules to the pattern recognizer, with request-scoped ReDoS/compile-cost bounds configurable per deployment.

Wire (nvisy-schema)

PatternRecognizerParams gets two new slots:

```rust
pub struct PatternRecognizerParams {
pub builtins: bool,
pub context_enhanced: bool,
pub custom: Vec, // NEW
pub custom_dictionaries: Vec, // NEW
}
```

New wire types under `nvisy_schema::plan`:

• `CustomPatternRule`, `CustomPatternVariant`, `CustomPatternContext` — regex-based rules mirroring `elide_pattern::Regex`, including optional `validator` names resolved against elide's `ValidatorRegistry`.
• `CustomDictionary`, `CustomDictionaryTerm` — literal-term rules mirroring `elide_pattern::Dictionary`.
• `MAX_REGEX_SOURCE_LEN` — 512-byte cap enforced at deserialize, the wire-side ReDoS anchor.

Types reuse elide's `LabelRef` and `Confidence` directly (both derive `JsonSchema` under `elide-core`'s `schema` feature). Re-exports `LabelRef` from `nvisy_schema::entity` and `Confidence` from `nvisy_schema::primitive` so SDK callers don't need `elide-core` as a separate dep.

Engine (`nvisy-engine`)

```rust
pub struct PatternGuardrails {
pub max_regex_source_len: usize, // default 512
pub max_custom_rules: usize, // default 32
pub max_dictionary_term_count: usize, // default 100_000
pub max_dictionary_term_bytes: usize, // default 8 MiB
}

Engine::new().with_pattern_guardrails(guardrails);
```

• `max_regex_source_len` is enforced twice: at deserialize in `nvisy-schema` as a hard ceiling, and at engine compile time against the deployment value. `with_pattern_guardrails` clamps values above the ceiling on the way in — deployments can only tighten below the wire limit.
• `max_custom_rules` — engine-side cap on `custom.len() + custom_dictionaries.len()` per request.
• `max_dictionary_term_count` / `max_dictionary_term_bytes` — passed to elide's `PatternRecognizerBuilder::with_term_count_limit` / `with_term_bytes_limit` (aggregate across every dictionary in the recognizer, builtin + custom).

Not wired: elide's `with_size_limit` / `with_dfa_size_limit` on the regex automaton. Elide's single-budget API can't separate per-regex NFA (small target) from the shared `RegexSet` union (must fit dozens of shipped builtins). See #317 for the split-budget follow-up.

Analyzer module reorg

Sibling to the feature: `analyzer/common.rs` split by role, matching the wire schema's shape.

Before:

```
analyzer/
mod.rs, catalog.rs, common.rs, guardrails.rs
ner.rs, llm.rs
text.rs, tabular.rs, image.rs, audio.rs
```

After:

```
analyzer/
mod.rs, catalog.rs
text.rs, tabular.rs, image.rs, audio.rs (~30–50 lines each, pure orchestration)
recognizer/{mod, pattern, guardrails, ner, llm}
enricher/{mod, language, ocr, stt}
layer/{mod, dedup}
```

OCR and STT were inline in `image.rs` / `audio.rs`; they now live next to `language` under `enricher/`. `PatternGuardrails` sits next to its owner `pattern.rs`. Public API (`nvisy_engine::PatternGuardrails`) unchanged.

Tests

`custom_patterns.rs` — 7 tests:

• `custom_regex_produces_entity_with_caller_label` — regex matching the fixture surfaces with the caller-supplied label.
• `custom_dictionary_produces_entity_with_caller_label` — same for the literal-term dictionary path.
• `overlong_regex_source_rejects_at_deserialize` — 513-byte regex fails at wire boundary, naming the cap.
• `too_many_custom_rules_rejects_at_analyze` — 33 rules fail at engine compile, naming the cap.
• `tightened_rule_count_guardrail_takes_effect` — deployment sets `max_custom_rules: 4`, 5 rules fail with the tightened cap in the error.
• `tightened_regex_source_len_guardrail_takes_effect` — deployment sets `max_regex_source_len: 16`, 60-byte source fails.
• `regex_source_len_config_above_ceiling_is_clamped` — deployment sets `4096`, gets clamped to 512; in-code source over the ceiling still rejects.

Existing `multimodal.rs` tests unchanged; `PatternRecognizerParams` literal gets `..Default::default()` for the two new fields.

Verified locally

`make rust-ci` passes (`lint`, `test`, `doc`, `deny`).

Related

• Elide bump to `b0fbfbad`: shipped `with_size_limit` / `with_dfa_size_limit` / `with_term_count_limit` / `with_term_bytes_limit` on the pattern recognizer builder. This PR consumes the last two.
• Follow-up guardrails for custom pattern recognizer #317 — follow-up guardrails (split regex budget, AST refuse-list, per-match timeout, per-document budget).

🤖 Generated with Claude Code