[Feature] Add advanced deck-type data customization #971

Feature Description

Let template managers optionally customize the data used by a deck-type block without requiring ordinary recipe editing to become a field-binding exercise.

Are you intending to implement this feature?

Yes.

Current Behavior

The PowerPoint generator's data choices are hard-coded. A custom deck type could not tune which supported report data a slide type displays without exposing low-level placeholders or executable expressions.

Desired Behavior

Every supported slide type has sensible defaults. Managers can optionally open a constrained Customize data panel on a deck-type block to select compatible, named Ghostwriter fields and simple options. Presentation-style configuration remains visual; it never becomes a data-binding editor.

Use Case

A manager can tailor a branded debrief—such as using a particular report summary or selecting an evidence image—without making every manager learn raw placeholder mappings or without allowing unsafe code.

Implementation Suggestions

Build on the generic slide-type renderer from #970. Use an allow-listed, versioned data catalog with explicit output types. Do not add new per-report input prompts in the MVP: use existing report, project, client, team, evidence, BloodHound, and extra-field data plus recipe-level static text.

Stack this PR on the PR for #970.

Additional Information

Acceptance criteria

• Supported slide types provide documented defaults that require no field-by-field configuration.
• An optional Customize data panel exposes only compatible, named data choices for the selected slide type and abstract slot.
• The catalog supports appropriate report, project, client, team, finding, observation, objective, evidence, BloodHound, and existing extra-field data.
• Supported transformations are limited to typed, allow-listed operations such as date formatting, name joining, evidence selection, ordering, and static text.
• Recipe blocks do not define new report-generation prompts in the MVP.
• Recipe data choices never override report-level BloodHound inclusion or underlying permission and visibility rules.
• Recipes cannot execute arbitrary code, unrestricted Jinja, JavaScript, or object-attribute traversal.
• Validation identifies the affected block and option before publication or generation without discarding other draft edits.
• Existing reference-deck output continues to pass parity tests.
• Automated tests cover defaults, compatible and incompatible choices, missing data, BloodHound controls, permissions, serialization, and malicious input.
• Builder help documents the available options in plain language, with advanced technical detail only on demand.

Blocked by

• [Feature] Build and publish generic PowerPoint deck types #970