feat(knowledge): LLM reclassification engine (P3 stages 2-3)

[mkreyman]

feat(knowledge): LLM reclassification engine (P3 stages 2-3)

The backfill that moves the existing corpus onto the expanded taxonomy. Built
dry-run-first and cost-bounded so the 77k run is safe and reviewable.

Stage 2 -- classifier (config-based DI):

• ClassifierBehaviour: classify(title, body) -> {:ok, %{category, confidence}}.
• ClaudeCategoryClassifier: Anthropic-backed, reuses :anthropic_provider config,
  only ever returns an ACTIVE category (never the retired convention), and
  returns {:error, :not_configured} with no API key so it never mutates data with
  a placeholder verdict. DI via :category_classifier (mock in test).

Stage 3 -- KnowledgeReclassifyWorker (:knowledge queue, not scheduled -- kicked
on demand because it costs per-article LLM calls):

• run_mode "dry_run" (default): classifies everything, writes NOTHING, and emits
  a knowledge.reclassify_batch audit event per batch with a tally + by_transition
  breakdown (e.g. "convention->playbook" => 42). Run first, read the feed, then
  commit.
• run_mode "commit": writes category ONLY when confidence >= min_confidence AND
  proposed != current (write-on-confident-change), recording reclassified_from /
  reclassify_confidence in metadata. Low-confidence or same-category verdicts are
  no-ops, so an already-correct label can't be regressed. Because the classifier
  only returns active categories, every confident convention row is moved off
  convention -- the point of the backfill. Re-runs are convergent.
• Scale/cost bounds: keyset batches (batch_size, default 100) chained by cursor;
  max_per_run (default 1000) caps a single kick and the remainder resumes next
  kick (logged when hit). all_tenants fan-out mirrors the other knowledge workers
  (active tenants only). batch_size/max_per_run/min_confidence are query-shaped
  tunables, settable per-kick in args (falling back to config, then defaults).

Tests: dry-run writes nothing + tallies; commit write-on-confident-change;
below-threshold no-op; proposed==current no-op; convention always moved; errored
classification left alone; cost-ceiling stop-and-resume; all_tenants fan-out
(skips suspended); tenant isolation; classifier not-configured degradation.
Full local gate green (format, credo --strict, dialyzer 0 errors).

The actual 77k run is an operator step (needs prod Anthropic access + a cost
decision): kick a dry_run, review the by_transition audit feed, then kick commit.