feat: add data export management API

[tgmendes]

Builds on the database invariant from #5859.

Summary

• Add the project-scoped dataExports Goa management service, SQLc repository, generated Go/TypeScript SDK surfaces, and generic listDestinations, createDestination, updateDestination, and deleteDestination operations alongside route CRUD.
• Represent each destination as a generic envelope with a destination_type discriminator and transport-specific configuration. OTEL configuration remains typed under otel; handlers dispatch CRUD by type and aggregate per-table list results in stable order so future SIEM and S3 destinations can live in their own tables without flattening transport-specific fields into one model.
• Require org:read for reads and org:admin for mutations while retaining the selected-project header and project-pinned persistence. Every repository query is pinned by both organization and project.
• Keep one non-deleted route configuration per project and data source with nullable typed destination slots. This change implements otel_destination_id; future destination types can add sibling slots on the same route row.
• Store OTEL headers as one encrypted, write-only map. Responses and audit snapshots expose only header names and whether a value exists; omitted update values preserve the existing secret by case-insensitive header name.
• Store and validate the destination-level sensitive_data egress policy, defaulting missing database values to exclude. This PR does not implement payload sanitization or define the eventual field-removal contract.
• Serialize destination secret merges, deletion checks, and route lifecycle changes with row locks, and record destination and route audit events atomically with each mutation.

Motivation

Migration PR #5859 establishes one non-deleted route row per project and data source while retaining nullable typed destination slots. This PR supplies the organization-authorized application boundary needed to manage that schema safely without making the management API OTEL-specific. Transport-specific configuration and persistence remain isolated, allowing SIEM, S3, and other destination types to use separate tables while sharing one stable destination and routing API.

[changeset-bot]

🦋 Changeset detected

Latest commit: a76aa6c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
server	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

Running ultrareview automatically — 'Adds a new tenant-scoped data export API with authorization, write-only encrypted secrets, row-lock concurrency, and audit events across 80 files and generated SDKs — a bug in project scoping, secret handling, or route lifecycle could leak data or credentials across tenants.'. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 15m 37s

All reported issues were addressed across 80 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 24 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[tgmendes]

Flaky ClickHouse startup; rerun passed.

[cubic-dev-ai]

All reported issues were addressed across 54 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>