docs(task-89): ApeRAG 全路径埋点 spec v1

per earayu2 directive (#indexing优化 msg=1331d5e7) + 4 guardrail (不无限扩范围 / 简单稳定 / 私有化部署免维护 / 尽快上线) + 全 lane fold-in input.

## P0 scope

- Layer 0 data model: PG telemetry_event table + Pydantic schemas + Alembic migration + 3 composite index + retention 30 days
- Layer 1 Phase 1 producer: graph_extractor._extract_one_window window event + GraphModalityWorker.sync document summary in-run counters (per ziang)
- Layer 2 ingestion: async batched flush + DISABLE_TELEMETRY env + fail-safe Class 1 (DB missing) + Class 2 (flush exception NOT propagate to indexing state)
- Layer 4 boundary: 7 boundary test (privacy AST gate + DISABLE_TELEMETRY + fail-safe Class 1+2 + chunk_ids cardinality cap + retention cleanup + event_type naming invariant)

## Sub-task split (per Weston foundation 优先级 X1+X3 → X2+X4)

- X1+X3 foundation PR: data model + ingestion + DISABLE_TELEMETRY env (Bryce/ziang)
- X2 producer PR: window/document event emit (ziang)
- X4 boundary PR: 7 boundary test (huangzhangshu)
- X5 Helm DISABLE_TELEMETRY + retention SRE (Planetegg)

## P1/P2 deferred (data-driven)
- P1 worker lane lifecycle (NOT Celery per ziang) + admin metrics endpoint 三层 typed schema (dongdong+cuiwenbo) + Grafana docs (Planetegg)
- P2 retrieval + LLM call producer

## Input fold-in trail
- Planetegg DISABLE_TELEMETRY P0 + retention P0 + producer stats return
- Weston retention/cardinality budget + in-run counters NOT realtime aggregate + foundation PR 依赖顺序
- huangzhangshu privacy AST gate scan 范围 + fail-safe 两类 + failed event error_type whitelist NO error_message
- ziang 接入点修正 _extract_one_window + GraphModalityWorker (NOT graph_facts_worker.py) + worker lane NOT Celery + document_index_id retry 串联
- dongdong P1 三层 typed schema (raw_event/aggregate_bucket/time_range_summary) FE consume aggregated only

P0 验收 = SQL/query + tests, NO UI (per Weston)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: earayu