feat(esm_catalog): PR-B2 — queryables endpoints (OGC CQL2 filter schema)

[siligam]

Summary

Provenance: this implementation is substantially Paul Gierz's work, carried over from his esm-tools-plus/simcat/pgierz-workbench prototype branch (commits Mar–Apr 2026). This PR ports it, largely as-is, into the reviewable stack.

• Adds api/queryables.py: fully dynamic property discovery from live DuckDB data — no hardcoded property lists; works for NetCDF global attrs, namelist params, HPC info, and future extensions automatically
• Adds api/validation.py: is_safe_property_name() SQL injection guard used before any property name is interpolated into SQL
• Wires /queryables and /collections/{id}/queryables into app.py with QueryablesCache (5-minute TTL)
• STAC Browser's "Additional filters" CQL2 builder uses these endpoints to populate dropdown enum values

What's deferred

PR	Content
B3	/experiments hierarchy routes + paleo time presets
B4	/catalogs federation API + auth middleware

Test plan

• CI green on 3.9 + 3.12
• GET /queryables → 200, has $schema, type: object, properties with datetime
• GET /collections/{id}/queryables → 200, scoped to collection
• GET /collections/no-such/queryables → 404
• Landing page links include OGC queryables rel
• Each collection response has queryables link

🤖 Generated with Claude Code

[siligam]

Rebased onto the corrected PR-0 base (#1483) — test relocation to tests/test_esm_catalog/, restored dedicated CI workflow at the new path, and a couple of CI fixes (doctest-collection exclusion, eval_type_backport for pydantic on Python 3.9). No change to this PR's own diff/scope. CI is green.