fix(data): robust CSV parser, migration run state machine, shell script hardening

[amar-python]

Data Integrity & Safety (High Priority)

Based on feature/schema-validation (PR #7) since that branch contains the restructured backend/ layout these fixes target.

4. Robust CSV Parser

• New backend/services/csv_parser.py — dedicated CsvParser class extracted from migration_service._parse_csv_metadata (which previously swallowed every exception with a bare except: pass). It explicitly handles:
  • zero-byte / whitespace-only files (empty_file error)
  • ragged rows — data rows whose column count differs from the header, reported with line numbers
  • encoding mismatches — UTF-8 (BOM-aware) with Latin-1 fallback + explicit encoding_fallback warning
  • malicious header names — ;, --, quotes, backslashes, comment markers, and standalone SQL keywords (DROP, DELETE, …) are flagged as suspicious_header errors; legitimate headers like drop_zone_id still pass
• migration_service now delegates to it and logs every parse issue instead of silently ignoring it.
• backend/tests/test_csv_parser.py — 28 unit tests covering all four failure classes plus happy paths.

5. Migration Lifecycle State Machine

• RunStatus gains explicit READY and ERROR states (joining CREATED / UPLOADING / VALIDATING / MIGRATING / COMPLETED / FAILED).
• New explicit ALLOWED_TRANSITIONS map + can_transition() + MigrationRun.transition_to(), which raises InvalidStateTransition on illegal moves (e.g. COMPLETED → UPLOADING).
• Upload failure mid-way now flags the run as ERROR (previously it lingered in UPLOADING); the run recovers by re-uploading.
• Validation now ends in READY (passed) or ERROR (failed) — previously it always reverted to CREATED, even on failure (RunStatus.CREATED if passed else RunStatus.CREATED bug).
• All services (migration_service, schema_service, execution_service) route status changes through transition_to().
• Frontend dashboard chip colors updated for the new states.
• backend/tests/test_run_lifecycle.py — transition-rule matrix, transition_to guard tests, and API-level tests including a simulated mid-upload disk failure → ERROR → recovery.

6. Shell Script Hardening (backend/migration/build/)

• csv_loader.sh: strict table-name validator after sanitisation — ^[a-zA-Z_][a-zA-Z0-9_]*$ (blocks ;, --, quotes, spaces) plus PostgreSQL's 63-char identifier limit; --env token validated before use.
• csv_utilise.sh: --env token validated; eval echo "\$PG_DB_${E}" replaced with safe bash indirect expansion (${!var}) — removes a shell-injection path. (Its table-name validator already existed and is verified by tests.)
• Both scripts pass shellcheck with no word-splitting (SC2086) findings; all variable expansions double-quoted.

Verification

• pytest backend/tests/ → 108 passed (38 existing + 70 new)
• pytest -m "unit or regression or security or snapshot" backend/migration/tests/ → 39 passed (no regressions in legacy loader/utilise tests)
• Manual checks: csv_loader.sh '/tmp/bad;drop.csv' → rejected; --env 'dev; rm -rf /tmp/x' → rejected by both scripts; valid config still resolves DB/schema via indirect expansion
• bash -n + shellcheck clean; flake8 clean on all new Python

Checklist

• Tests added
• Verified workflow paths (no workflow changes in this PR)