fix: WS5 hazards batch - CORS, scheduler auth, reranker dedupe, wiring, write txns

- CORS: drop allow_credentials (wildcard origin + credentials told
  browsers to attach credentials for any site); origins configurable via
  CORS_ALLOW_ORIGINS (default * is safe without credentials). Verified
  live: preflight no longer advertises access-control-allow-credentials.
- Scheduler tasks: auth moved from a plain Authorization header (which
  the Scheduler's rest_api_executor does NOT env-substitute) to its
  auth {type: bearer, token: ${LIBRARY_API_KEY}} block, substituted from
  the Scheduler's own environment at execution time. The registrar no
  longer resolves the real key client-side, so it can never be persisted
  into the scheduled_tasks.config JSONB column. Also fixed: JSON bodies
  moved from the ignored "body" key to "payload" (the executor only
  reads config["payload"], so the tasks would have POSTed empty bodies
  and failed required-user validation).
- Reranker: parsed ranking indices are deduplicated preserving first
  occurrence (an LLM answer like "3,3,1" duplicated a result).
- HybridRAG wiring consolidated into dependencies.get_hybrid_rag_service
  (now including volatile_service); the inline copies in /query/hybrid
  and /wiki/pages/smart-create are gone - smart-create previously ran
  without the volatile leg, and the singleton was unused.
- Remaining Neo4j writes (GraphService ingestion/deletes/purges/entity
  mentions, webhook rename+delete cleanup, document-sync _index_graph,
  consolidation mark-processed/add-entity) moved from auto-commit
  execute_query to execute_write managed transactions with retry.

Verified end-to-end on the local dev server as llm_tester: /query/hybrid
200 with all five legs ok (volatile now active), background persistence
landed as one transaction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QbFZyDvYksazX6nYQYZ67L

tests/test_graph_service.py

@@ -27,6 +27,7 @@ def mock_neo4j():
     """Mock Neo4j client."""
     mock = AsyncMock()
     mock.execute_query = AsyncMock(return_value=[{"d": {"page_id": TEST_PAGE_ID}}])
+    mock.execute_write = AsyncMock(return_value=[{"d": {"page_id": TEST_PAGE_ID}}])
     return mock
 
 
@@ -89,12 +90,12 @@ class TestDocumentNodeCreation:
             user=TEST_USER
         )
 
-        # Verify execute_query was called
-        assert mock_neo4j.execute_query.called
+        # Verify the write transaction was used
+        assert mock_neo4j.execute_write.called
         assert result.success is True
 
         # Find the document creation query
-        calls = mock_neo4j.execute_query.call_args_list
+        calls = mock_neo4j.execute_write.call_args_list
         doc_creation_call = None
         for call in calls:
             query = call[0][0] if call[0] else ""
@@ -128,7 +129,7 @@ class TestDocumentNodeCreation:
         assert result.success is True
 
         # Find the document creation query
-        calls = mock_neo4j.execute_query.call_args_list
+        calls = mock_neo4j.execute_write.call_args_list
         doc_creation_call = None
         for call in calls:
             query = call[0][0] if call[0] else ""
@@ -171,6 +172,7 @@ class TestEntityStubSkipping:
         assert result.success is True
         # Neo4j should NOT be called for entity-stub pages
         assert mock_neo4j.execute_query.call_count == 0
+        assert mock_neo4j.execute_write.call_count == 0
 
     @pytest.mark.asyncio
     async def test_skip_auto_generated_pages(
@@ -196,6 +198,7 @@ class TestEntityStubSkipping:
 
         assert result.success is True
         assert mock_neo4j.execute_query.call_count == 0
+        assert mock_neo4j.execute_write.call_count == 0
 
 
 class TestPageNotFound:
@@ -242,7 +245,7 @@ class TestEntityExtraction:
 
         assert result.success is True
         # Should have called neo4j at least once (for document node)
-        assert mock_neo4j.execute_query.called
+        assert mock_neo4j.execute_write.called
 
 
 if __name__ == "__main__":