Phase 7: AI-assisted query authoring (autocomplete, explain, fix, optimize, NL translation)

Adds a self-hosted (Ollama, qwen2.5-coder) model provider abstraction
with a pluggable opt-in cloud adapter, schema grounding, and a shared
cost/safety guard every AI-suggested query is assessed against --
compiling to and executing through the same unchanged Phase 2 IR/
compiler and Phase 4 tenant scoping as a hand-written query, no
parallel execution path.

Track A (built into the query bar): inline ghost-text autocomplete,
"Explain this query", "Fix this query" with a diff view, and a
rule-based "Optimize" suggestion. Track B: natural-language-to-query
translation, always a separate review step from execution, with
`sentryctl query --nl` requiring explicit confirmation to run.
Every accepted/dismissed translate-fix-optimize interaction is logged
into the same append-only audit_log table Phase 4 built.

Two real product bugs were found and fixed via live browser
verification (a Svelte effect re-running on every keystroke that
silently cancelled the ghost-text debounce; a ghost-text widget
positioned at document offset 0 instead of the cursor), and a real
costguard logic bug (unbounded-aggregation vs. raw-row) was caught by
its own test suite. New integration tests wire a real Ollama client
through the real HTTP handler against a mock server matching Ollama's
wire contract (hack/mock-ollama), keeping model-quality verification
out of CI as a disclosed, periodic human-run check instead.

See /docs/phase-7-ai-design.md and /docs/phase-7-runbook.md.

api/cmd/api/main.go

@@ -19,6 +19,10 @@ import (
 	"github.com/ClickHouse/clickhouse-go/v2"
 	"github.com/jackc/pgx/v5/pgxpool"
 
+	"github.com/sentry/sentry/api/ai/aiapi"
+	"github.com/sentry/sentry/api/ai/grounding"
+	"github.com/sentry/sentry/api/ai/provider/ollama"
+	"github.com/sentry/sentry/api/ai/router"
 	"github.com/sentry/sentry/api/authz"
 	"github.com/sentry/sentry/api/dashboards"
 	"github.com/sentry/sentry/api/httpserver"
@@ -28,6 +32,13 @@ import (
 	"github.com/sentry/sentry/api/searchclient"
 )
 
+// groundingRefreshInterval matches chwriter.Registry/search's
+// ActiveTenantTracker's own one-minute refresh cadence -- no strong
+// reason for a different number, and consistency means one interval to
+// reason about across every "sample something periodically" mechanism
+// in this codebase, not several slightly different ones.
+const groundingRefreshInterval = time.Minute
+
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
@@ -116,6 +127,32 @@ func main() {
 	queryHandler.RegisterRoutes(mux)
 	dashboardsHandler.RegisterRoutes(mux)
 
+	// AI routes (Phase 7) are only registered at all when OLLAMA_BASE_URL
+	// is set -- an unconfigured deployment gets a plain 404 on /ai/*
+	// rather than every request failing against an unreachable
+	// localhost:11434, matching "no cloud dependency required for the
+	// default deployment" by not forcing a *local* model dependency on a
+	// deployment that doesn't want AI features either.
+	if cfg.AI.OllamaBaseURL != "" {
+		groundingSvc := grounding.New(sqlRunner)
+		groundingSvc.StartRefreshing(ctx, groundingRefreshInterval, func(err error) {
+			logger.Warn("grounding refresh failed", "error", err)
+		})
+
+		defaultProvider := ollama.New(cfg.AI.OllamaBaseURL, cfg.AI.OllamaModel)
+		aiRouter := router.New(defaultProvider)
+		if cfg.AI.OllamaFastModel != "" && cfg.AI.OllamaFastModel != cfg.AI.OllamaModel {
+			aiRouter.SetOperation(router.OpComplete, ollama.New(cfg.AI.OllamaBaseURL, cfg.AI.OllamaFastModel))
+		}
+
+		// nil interaction logger: core has no enterprise/internal/audit
+		// implementation to log translate/fix/optimize interactions
+		// against, same posture as queryHandler's nil audit logger above.
+		aiHandler := aiapi.NewHandler(logger, aiRouter, groundingSvc, authorizer, nil)
+		aiHandler.RegisterRoutes(mux)
+		logger.Info("ai routes enabled", "ollama_base_url", cfg.AI.OllamaBaseURL, "model", cfg.AI.OllamaModel)
+	}
+
 	srv := &http.Server{
 		Addr:    cfg.HTTPListenAddr,
 		Handler: httpserver.WithCORS(mux, cfg.CORSAllowedOrigin),