Phase 7: AI-assisted query authoring (autocomplete, explain, fix, optimize, NL translation)

Adds a self-hosted (Ollama, qwen2.5-coder) model provider abstraction
with a pluggable opt-in cloud adapter, schema grounding, and a shared
cost/safety guard every AI-suggested query is assessed against --
compiling to and executing through the same unchanged Phase 2 IR/
compiler and Phase 4 tenant scoping as a hand-written query, no
parallel execution path.

Track A (built into the query bar): inline ghost-text autocomplete,
"Explain this query", "Fix this query" with a diff view, and a
rule-based "Optimize" suggestion. Track B: natural-language-to-query
translation, always a separate review step from execution, with
`sentryctl query --nl` requiring explicit confirmation to run.
Every accepted/dismissed translate-fix-optimize interaction is logged
into the same append-only audit_log table Phase 4 built.

Two real product bugs were found and fixed via live browser
verification (a Svelte effect re-running on every keystroke that
silently cancelled the ghost-text debounce; a ghost-text widget
positioned at document offset 0 instead of the cursor), and a real
costguard logic bug (unbounded-aggregation vs. raw-row) was caught by
its own test suite. New integration tests wire a real Ollama client
through the real HTTP handler against a mock server matching Ollama's
wire contract (hack/mock-ollama), keeping model-quality verification
out of CI as a disclosed, periodic human-run check instead.

See /docs/phase-7-ai-design.md and /docs/phase-7-runbook.md.

api/ai/costguard/costguard_test.go

@@ -0,0 +1,100 @@
+package costguard
+
+import (
+	"testing"
+	"time"
+
+	"github.com/sentry/sentry/api/internal/querylang/ir"
+)
+
+// A raw-row (non-aggregation) query with no time range and no explicit
+// Limit still gets executor/sql.go's defaultRowLimit=100 safety net
+// applied automatically -- so this is a Warn (a possibly-expensive scan
+// to find those 100 rows), not a Reject (genuinely unbounded output),
+// which only an unbounded *aggregation* actually is. See the case
+// immediately below for that contrast.
+func TestAssessNoTimeRangeNoLimitRawRowWarns(t *testing.T) {
+	plan := &ir.Plan{Filters: []ir.FilterPredicate{{Field: "service", Op: "=", Value: "api"}}}
+	got := Assess(plan)
+	if got.Level != LevelWarn {
+		t.Errorf("Level = %v, want warn (executor applies a default row limit even with no explicit Limit)", got.Level)
+	}
+	if len(got.Reasons) == 0 {
+		t.Error("expected at least one reason")
+	}
+}
+
+func TestAssessNoTimeRangeWithAggregationRejects(t *testing.T) {
+	plan := &ir.Plan{
+		TimeRange:   &ir.TimeRange{},
+		Aggregation: &ir.Aggregation{Funcs: []ir.AggFunc{{Func: "count", Alias: "count"}}},
+	}
+	got := Assess(plan)
+	if got.Level != LevelReject {
+		t.Errorf("Level = %v, want reject for an unbounded aggregation", got.Level)
+	}
+}
+
+func TestAssessNoTimeRangeWithLimitWarns(t *testing.T) {
+	plan := &ir.Plan{
+		TimeRange: &ir.TimeRange{},
+		Limit:     &ir.Limit{N: 100},
+	}
+	got := Assess(plan)
+	if got.Level != LevelWarn {
+		t.Errorf("Level = %v, want warn (limited, no aggregation)", got.Level)
+	}
+}
+
+func TestAssessBoundedTimeRangeIsOK(t *testing.T) {
+	now := time.Now()
+	plan := &ir.Plan{
+		TimeRange: &ir.TimeRange{From: now.Add(-1 * time.Hour), To: now},
+		Limit:     &ir.Limit{N: 100},
+	}
+	got := Assess(plan)
+	if got.Level != LevelOK {
+		t.Errorf("Level = %v, want ok, reasons: %v", got.Level, got.Reasons)
+	}
+}
+
+func TestAssessVeryLargeTimeRangeWarns(t *testing.T) {
+	now := time.Now()
+	plan := &ir.Plan{
+		TimeRange: &ir.TimeRange{From: now.Add(-200 * 24 * time.Hour), To: now},
+		Limit:     &ir.Limit{N: 100},
+	}
+	got := Assess(plan)
+	if got.Level != LevelWarn {
+		t.Errorf("Level = %v, want warn for a 200-day range", got.Level)
+	}
+}
+
+func TestAssessRawSQLWithTimestampFilterIsOK(t *testing.T) {
+	plan := &ir.Plan{RawSQL: "SELECT count(*) FROM logs WHERE timestamp > now() - INTERVAL 1 HOUR"}
+	got := Assess(plan)
+	if got.Level != LevelOK {
+		t.Errorf("Level = %v, want ok, reasons: %v", got.Level, got.Reasons)
+	}
+}
+
+func TestAssessRawSQLWithoutTimestampFilterWarns(t *testing.T) {
+	plan := &ir.Plan{RawSQL: "SELECT service, count(*) FROM logs GROUP BY service"}
+	got := Assess(plan)
+	if got.Level != LevelWarn {
+		t.Errorf("Level = %v, want warn for raw SQL with no detectable time filter", got.Level)
+	}
+}
+
+func TestSummaryEmptyForOK(t *testing.T) {
+	if s := Summary(Assessment{Level: LevelOK}); s != "" {
+		t.Errorf("Summary(OK) = %q, want empty", s)
+	}
+}
+
+func TestSummaryJoinsReasons(t *testing.T) {
+	a := Assessment{Level: LevelWarn, Reasons: []string{"a", "b"}}
+	if s := Summary(a); s != "a; b" {
+		t.Errorf("Summary = %q, want %q", s, "a; b")
+	}
+}