feat: add verified evidence chains and source highlighting

[CognitiveCodeAI]

Summary

This update makes answer evidence auditable in the original source document and adds HyCE-RAG-inspired, query-aware evidence chains for multi-hop questions.

• adds Evidence Highlighting V2 with immutable document/version/hash/page/quote provenance and normalized original-PDF rectangles
• validates structured citations against the exact packed context, performs bounded repair, and fails closed rather than manufacturing a source
• adds ACL-filtered, bounded evidence-chain routing, propagation, path assembly, context packing, audit output, and baseline fallback
• adds the Why this answer? evidence-path UI and verified source navigation
• adds migration 014, native-PDF source-span capture, compatibility coverage reporting, and a backfill command
• adds locked legal, clinical, ACL, single-hop, unsupported-answer, provenance, highlighting, and answer-level A/B evaluations
• documents staged rollout, rollback, limitations, and production-readiness gates

Why

The previous source-review path could show context without proving that the displayed location was the exact text used for the answer. That is insufficient for legal and clinical review. A verified evidence label now requires an independently checked node, document version, content hash, page, exact quote, and source locator. Approximate or unresolved evidence is never promoted to verified.

Evidence-chain scores rank relevance only. They do not represent truth, medical confidence, legal confidence, or private model reasoning.

Safety and rollout

• evidence chains remain disabled by default with a global feature flag
• inaccessible nodes are filtered before traversal, scoring, packing, generation, citation hydration, and audit serialization
• wrong document/page/version/hash and ambiguous quote cases fail closed
• pure abstentions cannot carry citations
• the original baseline path remains available through the feature flag and request mode
• scanned/OCR documents without trustworthy coordinates remain approximate or unavailable

This change is suitable for a controlled pilot, not broad production default-on. Production promotion still requires representative legal/clinical domain review, full infrastructure validation, and production-like load/concurrency testing.

Validation

• backend: 384 passed, 135 infrastructure-dependent tests intentionally skipped in the default run
• explicit route/PostgreSQL integration selection: 45 passed
• locked retrieval evaluator: 12/12 passed
• deterministic and configured-model paired A/B reports: all curated gates passed
• configured-model safety results: 0 unauthorized evidence leaks and 0 wrong-locator acceptances
• frontend: 12 tests passed
• ESLint: 0 errors; 30 pre-existing warnings
• Next.js production build and TypeScript: passed; 16 static pages generated
• Alembic: clean upgrade through revision 014 plus 014 downgrade/upgrade rehearsal passed
• browser: evidence path opened the original PDF with the verified overlay and no accessibility warnings

The chain computation measured 0.94 ms at p95, but total provider request p95 was 31.29% higher in the small 12-case configured-model run. This is explicitly documented as an observational result requiring representative load testing before default-on.

Review guide

Start with:

• backend/docs/EVIDENCE_HIGHLIGHTING_V2.md
• backend/docs/HYCE_EVIDENCE_CHAINS_ADOPTION.md
• backend/docs/HYCE_EVIDENCE_CHAINS_VERIFICATION.md
• backend/app/qa/evidence_chain.py
• backend/app/llm/openai_client.py
• backend/app/services/highlighting.py
• frontend/src/app/(app)/chat/chat-client.tsx

Repository hygiene

Local research-paper files, browser session state, screenshots, and workspace instructions were intentionally excluded from this commit.