…s for search

Store label_lower and fqn_lower on every node during bulkSave() so that
case-insensitive search can hit a B-tree index instead of doing a full
graph scan with toLower() on both sides of the CONTAINS predicate.

- nodeToProps(): adds label_lower/fqn_lower to the Neo4j property map
- bulkSave(): creates indexes on label_lower and fqn_lower
- EnrichCommand: creates label_lower/fqn_lower indexes alongside kind/layer/module/filePath
- GraphStore.search(text, limit): lowercase input, query against pre-lowered props
- GraphRepository.search(): same query update (SDN path)
- nodeFromNeo4j(): label_lower/fqn_lower implicitly excluded (no prop_ prefix)

All 1459 tests pass.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

…RE and ENDPOINT nodes

Implements RAN-61. GuardLinker uses file-path proximity (same file = match)
to infer that guards and middleware in a file protect endpoints in that file.
This surfaces security architecture in the graph for Spring @PreAuthorize,
@secured, DjangoAuth, FastAPIAuth, NestJSGuards, and generic middleware nodes.

- 9 unit tests: positive match, middleware, class-level, cross-file negative,
  no-guards, no-endpoints, duplicate avoidance, null filePath, determinism
- 1468 total tests pass, 0 failures

Co-Authored-By: Paperclip <noreply@paperclip.ing>

…tection

- Add GUARD, MIDDLEWARE, TOPIC, QUEUE, EVENT, MESSAGE_QUEUE to ENTRY_POINT_KINDS
  so they are never flagged as dead code (they are entry points / cross-cutting concerns)
- Remove invalid 'uses' edge kind from SEMANTIC_EDGE_KINDS (not a valid EdgeKind)
- Add 'protects' to SEMANTIC_EDGE_KINDS so PROTECTS edges from GuardLinker count
  as semantic usage when determining reachability
- Add two new tests: verifying new entry point kinds are excluded, and verifying
  'protects' is included / 'uses' is excluded from semantic edge kinds

Co-Authored-By: Paperclip <noreply@paperclip.ing>

- NestJSControllerDetector: bail out early if no @nestjs/ import to prevent false positives on Angular controllers and generic TypeScript
- NestJSGuardsDetector: bail out early if no @nestjs/ import to prevent false positives on any TypeScript with canActivate()
- NestJSControllerDetector: add edge.setTarget(node) on EXPOSES edges — previously missing, causing all class→endpoint edges to be silently dropped by GraphBuilder

Co-Authored-By: Paperclip <noreply@paperclip.ing>

…STENS edges

Tibco EMS, Azure Service Bus/Event Hub, and Spring Events emit different
edge kinds than Kafka/RabbitMQ. TopicLinker previously only matched
PRODUCES/CONSUMES, silently dropping cross-service CALLS edges for
all three messaging patterns.

- Add SENDS_TO and RECEIVES_FROM (Tibco/Azure) as producer/consumer edges
- Add PUBLISHES and LISTENS (Spring Events) as producer/consumer edges
- Add EVENT and MESSAGE_QUEUE node kinds to topic matching (alongside TOPIC/QUEUE)
- Add 4 new test cases: SENDS_TO/RECEIVES_FROM, PUBLISHES/LISTENS, MESSAGE_QUEUE, determinism

Co-Authored-By: Paperclip <noreply@paperclip.ing>

B-tree indexes on label_lower/fqn_lower cannot serve CONTAINS queries in
Neo4j — every search caused a full graph scan. Replace with a fulltext
index using the keyword analyzer so wildcard (*text*) queries are backed
by an index.

- Add FULLTEXT INDEX search_index on (n.label_lower, n.fqn_lower) in
  both GraphStore.bulkSave() and EnrichCommand secondary-index block
- Use keyword analyzer to preserve whole-property tokens (avoids Lucene
  tokenisation splitting FQNs on dots)
- Replace search() CONTAINS queries with
  db.index.fulltext.queryNodes() + *text* wildcard wrapping
- Escape Lucene special characters before wrapping in toLuceneQuery()
- Add CALL db.awaitIndexes(300) after secondary index creation in
  EnrichCommand so the first search request hits the index

Fixes RAN-66

Co-Authored-By: Paperclip <noreply@paperclip.ing>