feat: classify sensitive columns locally

backend/test/config.test.ts

@@ -81,6 +81,35 @@ test("loadConfig keeps local development defaults", () => {
   expect(loadConfig({}).dataRoot).toBeUndefined();
 });
 
+test("loadConfig keeps local NER disabled unless an absolute model path is configured", () => {
+  expect(loadConfig({}).sensitivityNer).toBeUndefined();
+  expect(loadConfig({
+    THT_SENSITIVITY_NER_MODEL_PATH: "/models/gliner2-pii",
+  }).sensitivityNer?.pythonExecutable).toBe("/opt/sensitivity-ner/bin/python");
+  expect(loadConfig({
+    THT_SENSITIVITY_NER_MODEL_PATH: "/models/gliner2-pii",
+    THT_SENSITIVITY_NER_PYTHON: "/opt/sensitivity-ner/bin/python",
+    THT_SENSITIVITY_NER_WORKER: "/app/backend/python/sensitivity_ner_worker.py",
+    THT_SENSITIVITY_NER_THREADS: "3",
+  }).sensitivityNer).toEqual({
+    modelPath: "/models/gliner2-pii",
+    pythonExecutable: "/opt/sensitivity-ner/bin/python",
+    workerScript: "/app/backend/python/sensitivity_ner_worker.py",
+    threads: 3,
+  });
+});
+
+test("loadConfig rejects ambiguous or unsafe local NER configuration", () => {
+  expect(() => loadConfig({ THT_SENSITIVITY_NER_MODEL_PATH: "fastino/model" }))
+    .toThrow("sensitivity NER model path configuration is invalid");
+  expect(() => loadConfig({
+    THT_SENSITIVITY_NER_MODEL_PATH: "/models/gliner2-pii",
+    THT_SENSITIVITY_NER_THREADS: "0",
+  })).toThrow("sensitivity NER thread configuration is invalid");
+  expect(() => loadConfig({ THT_SENSITIVITY_NER_PYTHON: "/opt/ner/bin/python" }))
+    .toThrow("sensitivity NER settings require a model path");
+});
+
 test("loadConfig allows none and mock only outside production when auth.yaml is absent", () => {
   const originalNodeEnvironment = process.env.NODE_ENV;
   delete process.env.NODE_ENV;