feat: enterprise hardening (bug fixes + observability, server, connectors scale, statistical checks, contracts, CI exporters)

[andreahlert]

Enterprise hardening: bug fixes + 4 feature clusters

Builds on top of current main (rebased). Full CI gate green locally in a deps-missing env matching CI (uv sync --all-extras --dev): pytest 619 passed / 39 skipped, ruff check, ruff format --check, and mypy provero-core/src/provero/ all clean.

Bug fixes (hardening of error paths)

Fixes a family of unhandled-exception and silent-correctness bugs, each with a regression test:

• Alerts: env-var resolution (URL + headers) no longer crashes the CLI; AlertConfig validates URL and trigger.
• Contracts: freshness/completeness SLA parsing emits a violation instead of raising.
• Anomaly detectors: guard threshold == 0 and non-finite inputs (no ZeroDivisionError, no inf-poisoned ranges).
• Profiler: INTERVAL columns no longer misclassified as numeric.
• Optimizer: _safe_alias is injective (no a.b vs a__dot__b collision); row_count/NULL semantics aligned across optimized and standalone paths.
• dbt export: rejects non-finite range bounds.
• Connectors: connection objects support the context-manager protocol.

Feature clusters

1. Observability + governance (observability/): engine hook API, OpenTelemetry spans, Prometheus /metrics, JSON audit log, secret redaction. CLI flags --audit-log/--otel/--prometheus. Optional observability extra.
2. Server mode (server/): FastAPI REST API (/health /ready /suites /suites/{name}/run /runs /metrics), constant-time API-key auth, threading scheduler, provero serve. Optional server extra.
3. Connector scale: pooling, retry with backoff, and timeouts for SQLAlchemy-backed connectors.
4. Statistical checks + contracts + CI output: 4 new checks (distribution, cardinality, drift/PSI, cross_table_count, now 20 total), contract versioning + breaking-change detection + severity policies, and --format sarif|junit exporters for CI.

Classifier bumped Pre-Alpha to Beta. Optional deps are tagged with # type: ignore[import-not-found] per the existing convention so mypy stays clean without the extras installed.