Adds /v1/dataquery/* endpoints proxying to dataquery-api (ClickHouse)
and Yente/OpenSanctions (Hetzner):
POST /v1/dataquery/company/lookup — search RO/DE/UK/US registries
POST /v1/dataquery/sanctions — OFAC SDN + OpenSanctions (HIT/CLEAR)
GET /v1/dataquery/:group/schema — ClickHouse group schema
POST /v1/dataquery/:group/query — raw SELECT within group scope
SQL injection prevention via sanitize() + dataquery-api table-scope enforcement.
Timeouts: 12s per upstream call. Promise.allSettled for parallel fan-out.
