feat: protect sensitive catalog samples

backend/test/catalog-schema-routes.test.ts

@@ -234,16 +234,30 @@ test("keeps generated descriptions editable and preserves them across synchroniz
   });
   expect(editedTable.json()).toMatchObject({ description: null, generatedDescription: "Generated table draft" });
   const idColumn = (await repository.listColumns(database.id, patients.id))[0];
+  expect(idColumn.sensitive).toBe(false);
   const editedColumn = await app.inject({
     method: "PATCH", url: `/catalog/databases/${database.id}/tables/${patients.id}/columns/${idColumn.id}`,
-    payload: { version: idColumn.version, description: "Reviewed key", generatedDescription: "Generated key draft" },
+    payload: {
+      version: idColumn.version,
+      description: "Reviewed key",
+      generatedDescription: "Generated key draft",
+      sensitive: true,
+    },
+  });
+  expect(editedColumn.json()).toMatchObject({
+    description: "Reviewed key",
+    generatedDescription: "Generated key draft",
+    sensitive: true,
   });
-  expect(editedColumn.json()).toMatchObject({ description: "Reviewed key", generatedDescription: "Generated key draft" });
 
   const second = await app.inject({ method: "POST", url: `/catalog/databases/${database.id}/sync-runs`, payload: { version: database.version, scope: "all", tableIds: [] } });
   await waitFor(repository, second.json().id, "succeeded");
   expect(await repository.getTable(database.id, patients.id)).toMatchObject({ generatedDescription: "Generated table draft" });
-  expect(await repository.getColumn(database.id, patients.id, idColumn.id)).toMatchObject({ description: "Reviewed key", generatedDescription: "Generated key draft" });
+  expect(await repository.getColumn(database.id, patients.id, idColumn.id)).toMatchObject({
+    description: "Reviewed key",
+    generatedDescription: "Generated key draft",
+    sensitive: true,
+  });
 });
 
 test("consolidates non-empty generated table descriptions and reports skipped selections", async () => {