fix: WS5 hazards batch - CORS, scheduler auth, reranker dedupe, wiring, write txns

- CORS: drop allow_credentials (wildcard origin + credentials told
  browsers to attach credentials for any site); origins configurable via
  CORS_ALLOW_ORIGINS (default * is safe without credentials). Verified
  live: preflight no longer advertises access-control-allow-credentials.
- Scheduler tasks: auth moved from a plain Authorization header (which
  the Scheduler's rest_api_executor does NOT env-substitute) to its
  auth {type: bearer, token: ${LIBRARY_API_KEY}} block, substituted from
  the Scheduler's own environment at execution time. The registrar no
  longer resolves the real key client-side, so it can never be persisted
  into the scheduled_tasks.config JSONB column. Also fixed: JSON bodies
  moved from the ignored "body" key to "payload" (the executor only
  reads config["payload"], so the tasks would have POSTed empty bodies
  and failed required-user validation).
- Reranker: parsed ranking indices are deduplicated preserving first
  occurrence (an LLM answer like "3,3,1" duplicated a result).
- HybridRAG wiring consolidated into dependencies.get_hybrid_rag_service
  (now including volatile_service); the inline copies in /query/hybrid
  and /wiki/pages/smart-create are gone - smart-create previously ran
  without the volatile leg, and the singleton was unused.
- Remaining Neo4j writes (GraphService ingestion/deletes/purges/entity
  mentions, webhook rename+delete cleanup, document-sync _index_graph,
  consolidation mark-processed/add-entity) moved from auto-commit
  execute_query to execute_write managed transactions with retry.

Verified end-to-end on the local dev server as llm_tester: /query/hybrid
200 with all five legs ok (volatile now active), background persistence
landed as one transaction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QbFZyDvYksazX6nYQYZ67L

src/routers/wiki.py

@@ -23,11 +23,10 @@ from src.clients.neo4j_client import Neo4jClient
 from src.clients.qdrant_client import QdrantClientWrapper
 from src.clients.ollama_client import OllamaClient
 from src.core.dependencies import (
-    WikiJSDep, Neo4jDep, QdrantDep, OllamaDep, SearXNGDep, ContentExtractorDep,
+    WikiJSDep, Neo4jDep, QdrantDep, OllamaDep,
     verify_api_key, get_settings, get_hybrid_rag_service, get_ingestion_service,
     RequiredUserQuery
 )
-from src.services.hybrid_rag_service import HybridRAGService
 from src.services.wiki_page_writer import WikiPageWriter
 from src.services.entity_linking_utils import apply_bidirectional_entity_linking
 from src.config import Settings
@@ -180,8 +179,6 @@ async def smart_create_page(
     neo4j_client: Neo4jDep,
     qdrant_client: QdrantDep,
     ollama_client: OllamaDep,
-    searxng_client: SearXNGDep,
-    content_extractor: ContentExtractorDep,
     settings: Settings = Depends(get_settings),
     api_key: str = Depends(verify_api_key)
 ):
@@ -218,18 +215,13 @@ async def smart_create_page(
     try:
         user = request.user
 
-        # Build services
+        # Build services. HybridRAG comes from the single wiring point in
+        # dependencies so it includes volatile_service (a previous inline
+        # copy here lacked it).
         wiki_service = WikiService(wiki_client)
         vector_service = VectorService(qdrant_client, wiki_client, ollama_client)
         graph_service = GraphService(neo4j_client, wiki_client)
-        hybrid_rag_service = HybridRAGService(
-            vector_service=vector_service,
-            graph_service=graph_service,
-            searxng_client=searxng_client,
-            ollama_client=ollama_client,
-            content_extractor=content_extractor,
-            settings=settings
-        )
+        hybrid_rag_service = get_hybrid_rag_service()
         wiki_page_writer = WikiPageWriter(ollama_client=ollama_client, settings=settings)
 
         # Step 1-5: Research + Generate + Create page