Release v0.8.2 — Security & resilience hardening

[senseibelbi]

Summary

This PR bumps the AOP MCP server to v0.8.2 and implements security / resilience hardening based on the ToxMCP Audit Reviewed v2 findings.

Key changes

1. Hardened SPARQL query construction (AOP-01)

   • Introduces TemplateCatalog.render_safe() with categorized parameter binding: escaped string literals, scheme-validated URIs, cast integers, and explicitly separated trusted structural fragments.
   • Migrates all production adapters (aop_wiki.py, aop_db.py) away from unsafe template.format(**params) interpolation.
   • Fixes the CAS-URI injection path in map_chemical_to_aops by constructing the URI safely in Python with urllib.parse.quote.

2. Resilience controls for SPARQL endpoints (AOP-02)

   • Adds per-endpoint CircuitBreaker with CLOSED / OPEN / HALF_OPEN states.
   • Adds exponential backoff + jitter between retries in SparqlClient._dispatch().
   • Non-retryable 4xx client errors (SparqlQueryError) are surfaced immediately and do not count as circuit-breaker failures.

3. Strengthened draft audit chain (AOP-03 / AOP-04)

   • VersionMetadata now enforces checksum and previous_checksum as required fields.
   • Adds checksum_algorithm (default sha256-v1) so the verification algorithm is explicit.
   • Adds ElectronicSignature support with authored / reviewed / approved / rejected semantics.
   • Hardens verify_audit_chain() to reject unsupported algorithms, empty checksums, and broken chains.

4. Ontology drift protection scaffold (AOP-05)

   • Replaces hardcoded _iri_to_curie() logic with configurable CurieResolver and a shared AOP_CURIE_RESOLVER.
   • Adds OntologyMigrator framework with BFS pathfinding and term-mapping support in src/semantic/migration.py.

Follow-up fixes (post-review)

Addressed all Copilot code-review comments:

• Fixed circuit-breaker default inconsistency (success_threshold=1).
• Reset success_count on OPEN → HALF_OPEN transitions.
• Excluded SparqlQueryError from circuit-breaker failure counting.
• Tightened URI validation to reject SPARQL-breaking characters (<>"{}|^ and whitespace).
• Escaped \n, \r, \t in SPARQL literal rendering.
• Removed the dangling inchikey parameter from map_chemical_to_aops (was accepted but never used in the query template).
• Made the backoff retry test deterministic via monkeypatched asyncio.sleep and random.uniform.

Verification

• 231 unit tests passing (1 skipped)
• Live server smoke-tested on port 8050 (tools/list, search_aops, get_aop)

Version bump

• pyproject.toml: 0.8.1 → 0.8.2
• src/server/version.py: 0.8.1 → 0.8.2
• README updated with v0.8.2 changelog.