fix: WS5 hazards batch - CORS, scheduler auth, reranker dedupe, wiring, write txns

- CORS: drop allow_credentials (wildcard origin + credentials told
  browsers to attach credentials for any site); origins configurable via
  CORS_ALLOW_ORIGINS (default * is safe without credentials). Verified
  live: preflight no longer advertises access-control-allow-credentials.
- Scheduler tasks: auth moved from a plain Authorization header (which
  the Scheduler's rest_api_executor does NOT env-substitute) to its
  auth {type: bearer, token: ${LIBRARY_API_KEY}} block, substituted from
  the Scheduler's own environment at execution time. The registrar no
  longer resolves the real key client-side, so it can never be persisted
  into the scheduled_tasks.config JSONB column. Also fixed: JSON bodies
  moved from the ignored "body" key to "payload" (the executor only
  reads config["payload"], so the tasks would have POSTed empty bodies
  and failed required-user validation).
- Reranker: parsed ranking indices are deduplicated preserving first
  occurrence (an LLM answer like "3,3,1" duplicated a result).
- HybridRAG wiring consolidated into dependencies.get_hybrid_rag_service
  (now including volatile_service); the inline copies in /query/hybrid
  and /wiki/pages/smart-create are gone - smart-create previously ran
  without the volatile leg, and the singleton was unused.
- Remaining Neo4j writes (GraphService ingestion/deletes/purges/entity
  mentions, webhook rename+delete cleanup, document-sync _index_graph,
  consolidation mark-processed/add-entity) moved from auto-commit
  execute_query to execute_write managed transactions with retry.

Verified end-to-end on the local dev server as llm_tester: /query/hybrid
200 with all five legs ok (volatile now active), background persistence
landed as one transaction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QbFZyDvYksazX6nYQYZ67L

src/services/graph_service.py

@@ -469,7 +469,7 @@ class GraphService:
             RETURN d
             """
 
-            await self.neo4j.execute_query(doc_query, {
+            await self.neo4j.execute_write(doc_query, {
                 "page_id": page_id,
                 "title": page.get("title"),
                 "path": page.get("path"),
@@ -493,7 +493,7 @@ class GraphService:
                 RETURN e, r
                 """
 
-                result = await self.neo4j.execute_query(entity_query, {
+                result = await self.neo4j.execute_write(entity_query, {
                     "name": entity.text,
                     "page_id": page_id,
                     "confidence": entity.confidence
@@ -557,7 +557,7 @@ class GraphService:
         """
 
         try:
-            result = await self.neo4j.execute_query(
+            result = await self.neo4j.execute_write(
                 delete_query,
                 {"page_id": page_id}
             )
@@ -1353,7 +1353,7 @@ Feel free to expand it with more details!
         """
 
         try:
-            results = await self.neo4j.execute_query(
+            results = await self.neo4j.execute_write(
                 query,
                 {"page_id": page_id, "entity_names": names}
             )
@@ -1392,7 +1392,7 @@ Feel free to expand it with more details!
         """
 
         try:
-            result = await self.neo4j.execute_query(
+            result = await self.neo4j.execute_write(
                 delete_query,
                 {"document_id": document_id}
             )
@@ -1434,7 +1434,7 @@ Feel free to expand it with more details!
         """
 
         try:
-            result = await self.neo4j.execute_query(
+            result = await self.neo4j.execute_write(
                 delete_query,
                 {"paperless_id": paperless_id}
             )
@@ -1478,7 +1478,7 @@ Feel free to expand it with more details!
         """
 
         try:
-            result = await self.neo4j.execute_query(
+            result = await self.neo4j.execute_write(
                 delete_query,
                 {"collection_id": collection_id}
             )
@@ -1568,7 +1568,7 @@ Feel free to expand it with more details!
         """
 
         try:
-            results = await self.neo4j.execute_query(query, {})
+            results = await self.neo4j.execute_write(query, {})
             purged_count = results[0]["purged_count"] if results else 0
 
             logger.info(f"Purged {purged_count} orphan entities for user {user}")
@@ -1651,7 +1651,7 @@ Feel free to expand it with more details!
                 DETACH DELETE d
                 RETURN count(d) as purged_count
                 """
-                results = await self.neo4j.execute_query(query, {"page_ids": page_ids})
+                results = await self.neo4j.execute_write(query, {"page_ids": page_ids})
                 count = results[0]["purged_count"] if results else 0
                 total_purged += count
                 logger.info(f"Purged {count} wiki Document nodes")
@@ -1664,7 +1664,7 @@ Feel free to expand it with more details!
                 DETACH DELETE d
                 RETURN count(d) as purged_count
                 """
-                results = await self.neo4j.execute_query(query, {"document_ids": document_ids})
+                results = await self.neo4j.execute_write(query, {"document_ids": document_ids})
                 count = results[0]["purged_count"] if results else 0
                 total_purged += count
                 logger.info(f"Purged {count} Document Store Document nodes")
@@ -1702,7 +1702,7 @@ Feel free to expand it with more details!
         """
 
         try:
-            results = await self.neo4j.execute_query(query, {})
+            results = await self.neo4j.execute_write(query, {})
             cleaned_count = results[0]["cleaned_count"] if results else 0
 
             if cleaned_count > 0: