feat: protect sensitive catalog samples

backend/src/app.ts

@@ -56,6 +56,7 @@ import { metadataGenerationModelRoutes } from "./routes/metadata-generation-mode
 import { catalogDescriptionConsolidationRoutes } from "./routes/catalog-description-consolidation.js";
 import { PythonModelCompleter, type ModelCompleter } from "./catalog/model-completer.js";
 import { DescriptionGenerationWorker } from "./catalog/description-generation-worker.js";
+import { SensitiveDataSuggester } from "./catalog/sensitive-data-suggester.js";
 import {
   PostgresDescriptionSourceSampler,
   type DescriptionSourceSampler,
@@ -179,6 +180,11 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
     catalogOperationCoordinator,
     descriptionSourceSampler,
   );
+  const sensitiveDataSuggester = new SensitiveDataSuggester(
+    catalogRepository,
+    metadataGenerationModels,
+    modelCompleter,
+  );
   const catalogService = deps?.catalogService ?? new CatalogService(
     catalogRepository,
     workspaceRegistry,
@@ -438,6 +444,7 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
   catalogDescriptionGenerationRoutes(app, {
     repository: catalogRepository,
     worker: descriptionGenerationWorker,
+    sensitiveDataSuggester,
   });
   settingsRoutes(app, { cfg: config, listModels, getSettings });
   piManagementRoutes(app, { service: piManagement });