feat(analyst): Implement audit logging for query denial and clarification

- Enhanced the `AnalystAgent` class to include an `_audit_terminal` method for logging query denials, clarifications, and errors, ensuring compliance and traceability.
- Updated error handling paths to call the new audit method, capturing relevant details such as question, user authentication, and SQL context.
- Introduced new validation checks in `sql_guard.py` to enforce ownership filters for sensitive queries, improving security measures.
- Added unit tests to verify the correct logging behavior and ownership filter enforcement, ensuring robust functionality.

This update significantly strengthens the auditing capabilities of the analyst agent, enhancing security and compliance in query handling.

scripts/dev/sandbox_domain_test.py

@@ -40,7 +40,11 @@ def token(sub: str, roles: str, *, token_type: str = "staff", customer_id: str |
 def ask(tok: str | None, question: str) -> tuple[int, dict]:
     headers = {"Authorization": f"Bearer {tok}"} if tok else {}
     try:
-        r = client.post("/api/analyst/chat", headers=headers, json={"question": question})
+        r = client.post(
+            "/api/analyst/chat",
+            headers=headers,
+            json={"question": question, "interpret": True},
+        )
         try:
             body = r.json()
         except Exception: