feat(delta): browse, preview, verify, generate and validate on Unity Catalog; generated mappings key and join lowercase tables (Iceberg too) - #1902

… foreign keys

The generator's engine takes a plain table model, so it serves any
tabular catalog. Two things tied it to the catalogs it was first fed:

- its naming conventions (`_KEY` / `_ID` suffixes, `DIM_` / `FACT_`
  markers, the `<stem>_KEY` name fallback) matched uppercase only. They
  now ignore ASCII case, so a catalog that folds names to lowercase gets
  the same subject keys, join predicates and diagnostics. Output for
  uppercase names is unchanged; the golden mapping is byte-identical.
- it could only infer foreign keys, by name and type. A table may now
  carry the keys its catalog declares. A declared single-column key is
  joined as declared, including where the names would not match, where
  they suggest a different parent, and where the column sits inside the
  subject key. Nothing is inferred for a column a declared key covers. A
  key that spans several columns, names a table outside the mapping, or
  names a parent with no subject stays literal and says why.

Iceberg passes no declared keys, so its mappings are as before.

…e on Unity Catalog

None of these registers a source.

- preview: a table's columns as Unity records them, with the datatype a
  generated mapping would give each, whether a mapping can address it,
  masks, and the declared keys.
- verify: reads the table's log with the credentials Unity issues, the
  steps a query's first touch takes. A table that cannot be read is a
  report carrying the catalog's or the store's reason; a request that
  cannot be made is an error.
- generate: runs the shared mapping generator over Unity's description of
  each table. Tables are named `catalog.schema.table`, which `delta map`
  places through Unity with no defaults. Declared primary keys become
  subjects and declared foreign keys joins; a view or a table in another
  format is refused by name. Overrides are given by table name as the
  request spells it.
- validate: compiles a mapping and checks it against each table's own
  log, placed as a `delta map` request places it, so it serves sources by
  path too. A mapped column of a type the reader cannot carry is an
  error, since it fails every query on its table.

The mapping cross-check now runs over a format-neutral column, with the
two places its wording depended on Iceberg passed in; Iceberg's entry
point and its tests are unchanged. Registration and validate open a
placed table through one function.

Five read-only endpoints lead up to `delta/map`, beside Iceberg's:

  POST /delta/catalog/browse    catalogs, schemas or tables
  POST /delta/catalog/preview   one table's columns and declared keys
  POST /delta/catalog/verify    read the table with Unity's credentials
  POST /delta/r2rml/generate    a mapping from Unity's table records
  POST /delta/r2rml/validate    a mapping against the tables it names

They take the Unity connection fields `delta/map` takes, now one struct
with one builder, so the outbound-URL guard and the listed-variable rule
for secrets apply alike. `validate` takes a `delta/map` body whose `name`
is optional, so it checks exactly what a map of that body would read,
for sources by path as well. All five sit behind the admin gate with the
other reads that carry a secret and call out.

The two concurrent listings hold owned values so their futures are
`Send` inside a handler.

The read-only commands that lead up to `fluree delta map` on Unity
Catalog:

  fluree delta browse                     catalogs, schemas or tables
  fluree delta preview <table>            columns and declared keys
  fluree delta verify <table>             read it with Unity's credentials
  fluree delta generate <table>...        an R2RML mapping, to a file or stdout
  fluree delta validate --r2rml <file>    a mapping against its tables

Each runs on a named remote, on the local server when there is one, or
in process, and asks the same question either way: one request body per
command, under the endpoints' field names. `generate` writes the mapping
to standard output or `-o`, and what it had to decide to standard error;
`--subject-key` and `--class-name` override a table's key and class.
`verify` and `validate` exit non-zero on a table that cannot be read or a
mapping with an error, so a script can gate on them. `--json` prints the
endpoint's answer as is.

`delta map`'s options are regrouped into the connection, storage and
source sets the new commands share; its flags and behaviour are as
before.

…y are about

Run over Unity Catalog, the generator said a subject key came "from
Iceberg identifier_field_ids", called a `variant` column "a nested
struct/list/map", and closed two notes with internal planning shorthand.

The declared key's source is now an emit option, which Delta sets to the
primary key Unity Catalog declares and Iceberg leaves as it was. A column
that is passed over is described by its own type. The notes on
uniqueness say that it cannot be verified from metadata.

…ify, generate, validate

The Delta guide gains the path from a catalog to a registered source, the
CLI and endpoint references the five read-only operations, and the
Databricks walk-through a discovery step before mapping. The catalogs
limitation now says what remains: tables by path have no catalog to list,
and a generated mapping joins on single-column foreign keys.

… one client

Unity folds names to lowercase and matches them without regard to case,
but two places used the request's spelling:
- A catalog-wide browse recovered each schema's name by stripping
  "{catalog}." from Unity's full_name case-sensitively. With
  `--unity-catalog Main` it asked for schema `main.sales`, got a 404, and
  the whole listing aborted (the information_schema filter missed too).
  Each schema is now asked for by the catalog and schema names Unity
  returns.
- `describe` returned the name as requested, so `generate
  MAIN.SALES.ORDERS …` never matched a declared foreign key's parent
  (`main.sales.headers`) and silently dropped the join. A table is now
  known by Unity's full_name. Per-table overrides, given as requested,
  are keyed by the name each table was described as.

Generate built a UnityClient, and so did an OAuth token exchange, per
described table. `describe_unity_tables` describes them all over one
client, as browse already did.

…l is the table's

- `verify` read only the table's log, so a table whose data files can't
  be read (removed, or outside the prefix its credentials cover) reported
  readable. It now also stats the first data file through the table's own
  store, as Iceberg's verify does, and reports it as `probed_data_file`.
- A table Unity Catalog places where the reader can't follow (the local
  filesystem, or Google Cloud Storage) was refused as a config error.
  That made `verify` a 400 and failed the whole `delta map`. It is now
  that table's refusal: `verify` reports `readable: false` with the
  reason, and mapping registers the source with a named table warning,
  as for a view or a table with an access rule.

Both catalog verify endpoints now point at a single "Verify response"
reference in docs/api/endpoints.md, meant as the definition clients build
against. It has:
- the status contract: what is a 200 report, what is a 400 and with which
  @type, the admin 401, and that a table-level refusal is never a 403;
- one field table with type, when each field is null, which source type
  returns it, and what it means;
- readable and unreadable examples for each source.