[v0.3] Evidence Inspector: source, relation and rule provenance #33

Tracks #31. Target: v0.3 — Visualization → Investigation.

Problem

A visual edge or high-centrality node is not yet an actionable finding. Users need to know exactly what source data supports a relationship and which parts are inferred.

Scope

• Inspector for a selected node, relationship or investigation path.
• Display stable IDs, labels/types, raw relevant properties, connector/source instance and last successful sync timestamp when available.
• Define an evidence record containing source IDs, source snapshot/version, collection time, explicit vs derived assertion and optional rule ID.
• Handle legacy CSV/AWS datasets that lack fields with Unknown / Not supplied, not made-up timestamps.
• Provide Copy evidence as JSON; link evidence to a path/findings later.

Acceptance criteria

• AWS fixture relationship can be inspected with raw source details.
• A derived finding links to its underlying edge/node evidence and rule.
• Missing metadata clearly displays unknown status.
• API/CLI can expose stable machine-readable evidence IDs.
• No secrets, credentials or irrelevant payload fields end up in exports.

Out of scope: full incident case management.