🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

🛑 architecture (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Change to index naming convention and data mapping logic breaks existing OpenSearch indices and potentially downstream data consumers.

• high backend/pkg/constants/custom_integrations.go:4 — Changing CUSTOM_INDEX_PREFIX is a breaking change for existing data. This requires a migration strategy for existing OpenSearch indices to prevent data loss or access issues.
• medium backend/modules/integrations/usecase/module.go:170 — Changing the mapping from ModuleName to DataType in OpenSearch index patterns alters the data contract. Ensure this does not break existing dashboards or queries relying on the previous schema.

🛑 bugs (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Logic error in OpenSearch index creation and potential breaking change in index naming convention.

• high backend/modules/integrations/usecase/module.go:170 — Changed field from req.ModuleName to req.DataType. If the OpenSearch index pattern expects the module name, this will cause a mismatch in data routing or indexing logic.
• medium backend/pkg/constants/custom_integrations.go:4 — Changing CUSTOM_INDEX_PREFIX from 'custom' to 'v11-log' is a breaking change that will likely cause existing integrations to fail to find their indices.

⚠️ security (gemini-3-flash-lite) — non-blocking warnings

Summary: Potential path traversal or index injection via unvalidated DataType input in OpenSearch index creation.

• medium backend/modules/integrations/usecase/module.go:168 — The PatternModule field is now populated by req.DataType without apparent sanitization. If DataType is user-controlled, this could lead to OpenSearch index injection or path traversal-like behavior. Validate DataType against an allowlist.