feat(027): Final Phase T038-T043 implementation

- T038: SessionEvent logger and persistence logic
  - Added SessionEventLogger service with explicit audit event persistence
  - Added SessionEvent model with events relationship on DatasetReviewSession
  - Integrated event logging into orchestrator flows and API mutation endpoints

- T039: Semantic source version propagation
  - Added source_version column to SemanticFieldEntry
  - Added propagate_source_version_update() to SemanticResolver
  - Preserves locked/manual field invariants during propagation

- T040: Batch approval API and UI actions
  - Added batch semantic approval endpoint (/fields/semantic/approve-batch)
  - Added batch mapping approval endpoint (/mappings/approve-batch)
  - Added batch approval actions to SemanticLayerReview and ExecutionMappingReview components
  - Aligned batch semantics with single-item approval contracts

- T041: Superset compatibility matrix tests
  - Added test_superset_matrix.py with preview and SQL Lab fallback coverage
  - Tests verify client method preference and matrix fallback behavior

- T042: RBAC audit sweep on session-mutation endpoints
  - Added _require_owner_mutation_scope() helper
  - Applied owner guards to update_session, delete_session, and all mutation endpoints
  - Ensured no bypass of existing permission checks

- T043: i18n coverage for dataset-review UI
  - Added workspace state labels (empty/importing/review) to en.json and ru.json
  - Added batch action labels for semantics and mappings
  - Fixed workspace state comparison to lowercase strings
  - Removed hardcoded workspace state display strings

Signed-off-by: Implementation Specialist <impl@ss-tools>

specs/027-dataset-llm-orchestration/contracts/modules.md

@@ -115,6 +115,7 @@ This document defines the semantic contracts for the core components of the Data
 # @PRE: selected source and target field set must be known.
 # @POST: candidate ranking follows the configured confidence hierarchy and unresolved fuzzy matches remain reviewable.
 # @SIDE_EFFECT: may create conflict findings and semantic candidate records.
+# @DATA_CONTRACT: Input[SemanticSourceSelection | SemanticFieldSet | ManualFieldDecision] -> Output[SemanticCandidateSet | RankedSemanticResolution | ValidationFindingSet]
 # @INVARIANT: Manual overrides are never silently replaced by imported, inferred, or AI-generated values.
 # @TEST_CONTRACT: rank_candidates -> exact dictionary beats reference import beats fuzzy beats AI draft
 # @TEST_SCENARIO: manual_lock_survives_reimport -> locked field remains active after another source is applied
@@ -156,6 +157,7 @@ This document defines the semantic contracts for the core components of the Data
 # @PRE: target session contains unresolved or contradictory review state.
 # @POST: every recorded answer updates the clarification session and associated session state deterministically.
 # @SIDE_EFFECT: creates clarification questions, persists answers, updates findings/profile state.
+# @DATA_CONTRACT: Input[ClarificationSessionState | ClarificationAnswerCommand] -> Output[ClarificationQuestionPayload | ClarificationProgressSnapshot | SessionReadinessDelta]
 # @INVARIANT: Clarification answers are persisted before the current question pointer or readiness state is advanced.
 # @TEST_CONTRACT: next_question_selection -> returns only one highest-priority unresolved question at a time
 # @TEST_SCENARIO: save_and_resume_clarification -> reopening session restores current question and prior answers
@@ -184,9 +186,10 @@ This document defines the semantic contracts for the core components of the Data
 # @COMPLEXITY: 4
 # @PURPOSE: Recover dataset, dashboard, filter, and runtime-template context from Superset links and related API payloads.
 # @LAYER: Infra
-# @RELATION: [CALLS] ->[SupersetClient]
 # @RELATION: [DEPENDS_ON] ->[ImportedFilter]
 # @RELATION: [DEPENDS_ON] ->[TemplateVariable]
+# @RELATION: [DEPENDS_ON] ->[backend.src.core.superset_client.SupersetClient]
+# @DATA_CONTRACT: Input[SupersetLink | DatasetReference | EnvironmentContext] -> Output[RecoveredSupersetContext | ImportedFilterSet | TemplateVariableSet | RecoverySummary]
 # @PRE: Superset link or dataset reference must be parseable enough to resolve an environment-scoped target resource.
 # @POST: returns the best available recovered context with explicit provenance and partial-recovery markers when necessary.
 # @SIDE_EFFECT: performs upstream Superset API reads.
@@ -218,9 +221,10 @@ This document defines the semantic contracts for the core components of the Data
 # @COMPLEXITY: 4
 # @PURPOSE: Interact with Superset preview compilation and SQL Lab execution endpoints using the current approved execution context.
 # @LAYER: Infra
-# @RELATION: [CALLS] ->[SupersetClient]
 # @RELATION: [DEPENDS_ON] ->[CompiledPreview]
 # @RELATION: [DEPENDS_ON] ->[DatasetRunContext]
+# @RELATION: [DEPENDS_ON] ->[backend.src.core.superset_client.SupersetClient]
+# @DATA_CONTRACT: Input[ApprovedExecutionContext | PreviewFingerprint | LaunchRequest] -> Output[CompiledPreview | PreviewFailureArtifact | DatasetRunContext | LaunchFailureAudit]
 # @PRE: effective template params and dataset execution reference are available.
 # @POST: preview and launch calls return Superset-originated artifacts or explicit errors.
 # @SIDE_EFFECT: performs upstream Superset preview and SQL Lab calls.